e5012f5d679abb8263b49bf2301c07e7ab78d42af341208d2e817be42a1ac1dc

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:45

Target

05e9e5f51bb43ce17882fbe646479557.exe
Size

266KB
MD5

05e9e5f51bb43ce17882fbe646479557
SHA1

efdefd2639482a75c5d69ed938557ebe737d7e1f
SHA256

e5012f5d679abb8263b49bf2301c07e7ab78d42af341208d2e817be42a1ac1dc
SHA512

b891b771b2144510c46fe1fe99401d144e81e8fada09c8630dc14ce45f203a5dccd1c2d1c3d090c1fd6a1082c4af63a2db586e14b20ecfd83d3252794e1dd6cc
SSDEEP

6144:7HuC2LJhM7an2qRnG/a90c1YeFx4WHxyCwlTl5:6C2LJa7aASceFKgxyCwdl5

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2384	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	1432	05e9e5f51bb43ce17882fbe646479557.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 1432 wrote to memory of 2384	1432	05e9e5f51bb43ce17882fbe646479557.exe	28
PID 2384 wrote to memory of 2500	2384	05e9e5f51bb43ce17882fbe646479557.exe	29
PID 2384 wrote to memory of 2500	2384	05e9e5f51bb43ce17882fbe646479557.exe	29
PID 2384 wrote to memory of 2500	2384	05e9e5f51bb43ce17882fbe646479557.exe	29
PID 2384 wrote to memory of 2500	2384	05e9e5f51bb43ce17882fbe646479557.exe	29

memory/1432-10-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2384-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2384-2-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2384-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2384-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2384-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2384-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2384-12-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2384-13-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2384-14-0x0000000000400000-0x0000000000402300-memory.dmp

Filesize
8KB

Download