f2319d0f30c596e95da866275b71ffc504044c145cc8dd5bd721cb51c62366ef

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:44

Target

1de14ce8ad5193c17e20f2d2efe1d5ff.exe
Size

7.7MB
MD5

1de14ce8ad5193c17e20f2d2efe1d5ff
SHA1

88217f0d8bf6a3de80b6fdd16cc952500a817d2a
SHA256

f2319d0f30c596e95da866275b71ffc504044c145cc8dd5bd721cb51c62366ef
SHA512

0e1d85fe0d46fe57332bc20918b6d2bc3780e135f0ef185aa4e6a3edfa119cf4f87f9ca1b4d40666d6cac89f10da5aedd735d3a41a186c14551564cfb343021a
SSDEEP

196608:Dm3iT3VoCvevc3tg3v13uFnCPweXPidlcv3KYgzNVM/Ha0sP3vCCahzbskxZDZ:DBaCKv13uFnCPweXPidlcv3KYgzNVM/l

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	1de14ce8ad5193c17e20f2d2efe1d5ff.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1220	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1220	2840	1de14ce8ad5193c17e20f2d2efe1d5ff.exe	7
PID 1220 wrote to memory of 2856	1220	Explorer.EXE	30
PID 1220 wrote to memory of 2856	1220	Explorer.EXE	30
PID 1220 wrote to memory of 2856	1220	Explorer.EXE	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1220 -s 2236
  2⤵
  PID:2856

memory/1220-0-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2840-2-0x0000000000400000-0x00000000009AE000-memory.dmp

Filesize
5.7MB

Download