451f71d2cd2cc4483eed9cd9a74ed11c9e7127b542faa77e0447d50c1fe0e2db

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:54

Target

064f83fa753ac9eb125a16833147fe92.exe
Size

9KB
MD5

064f83fa753ac9eb125a16833147fe92
SHA1

9c62a0e83c88ae38b872dae91cce2f2cc0dc73cf
SHA256

451f71d2cd2cc4483eed9cd9a74ed11c9e7127b542faa77e0447d50c1fe0e2db
SHA512

c0baf11598834240efc682e204339b15521beebfd850dae34bcc8e06403a63c0f58943c76087529ecd91cc8e559d8817b96d2d972a770bc54bc4d18eeaca76a0
SSDEEP

192:oBksuvPY82gQv5F4qtAeMZZ3d93VnjdwCzc38A9c:s82l4qtAeMPFnhwCYt9

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	064f83fa753ac9eb125a16833147fe92.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2716	3044	064f83fa753ac9eb125a16833147fe92.exe	28
PID 3044 wrote to memory of 2716	3044	064f83fa753ac9eb125a16833147fe92.exe	28
PID 3044 wrote to memory of 2716	3044	064f83fa753ac9eb125a16833147fe92.exe	28

C:\Users\Admin\AppData\Local\Temp\064f83fa753ac9eb125a16833147fe92.exe
"C:\Users\Admin\AppData\Local\Temp\064f83fa753ac9eb125a16833147fe92.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 892
  2⤵
  PID:2716

memory/3044-0-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/3044-1-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-2-0x0000000000A60000-0x0000000000AE0000-memory.dmp

Filesize
512KB

Download
memory/3044-3-0x000007FEF6220000-0x000007FEF6C0C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-4-0x0000000000A60000-0x0000000000AE0000-memory.dmp

Filesize
512KB

Download