263ee93d12639ae37d977720412749027b8e1d3a2df4895309315e31eaea99c9

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 02:38

Target

00645327315ad17e610b0c8be608f4b0.exe
Size

9KB
MD5

00645327315ad17e610b0c8be608f4b0
SHA1

983c35db2ac9a815c966fcf4720dac26df0f349c
SHA256

263ee93d12639ae37d977720412749027b8e1d3a2df4895309315e31eaea99c9
SHA512

ace8a576f4e5fd01a06a8f5e422475ad56c4c94a5720befebffa59dcd6dbba13c2d0309549aa84c26ba73f2f09d7536b831759dfedc12a4ee9c9f879e5451cb7
SSDEEP

192:oBksuzPY82gQv5F4ftseMZZ3N93VnjdwCza3Ul/Lsd0:w82l4ftseM/FnhwCmElQ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	00645327315ad17e610b0c8be608f4b0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2588	1728	00645327315ad17e610b0c8be608f4b0.exe	30
PID 1728 wrote to memory of 2588	1728	00645327315ad17e610b0c8be608f4b0.exe	30
PID 1728 wrote to memory of 2588	1728	00645327315ad17e610b0c8be608f4b0.exe	30

C:\Users\Admin\AppData\Local\Temp\00645327315ad17e610b0c8be608f4b0.exe
"C:\Users\Admin\AppData\Local\Temp\00645327315ad17e610b0c8be608f4b0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1728 -s 896
  2⤵
  PID:2588

memory/1728-0-0x0000000001150000-0x0000000001158000-memory.dmp

Filesize
32KB

Download
memory/1728-1-0x000007FEF5680000-0x000007FEF606C000-memory.dmp

Filesize
9.9MB

Download
memory/1728-2-0x000000001AFE0000-0x000000001B060000-memory.dmp

Filesize
512KB

Download
memory/1728-3-0x000007FEF5680000-0x000007FEF606C000-memory.dmp

Filesize
9.9MB

Download
memory/1728-4-0x000000001AFE0000-0x000000001B060000-memory.dmp

Filesize
512KB

Download