5b6f2a779bea719e4bcc5243b58d459c1ad9c423bb09dfae2b6cc5d38225064c

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:14

Target

07262a5c5255f3acdc573c82b5b68ca8.exe
Size

115KB
MD5

07262a5c5255f3acdc573c82b5b68ca8
SHA1

83c7a944d221398a0febb08a459f869fe736b3b1
SHA256

5b6f2a779bea719e4bcc5243b58d459c1ad9c423bb09dfae2b6cc5d38225064c
SHA512

a2daa45580c0cbed8797d11f559203c4f023bc47c5515460affc8756fbdb3f6c8ad511697a01f1daf5cce063d38c0c8d588273d573b26a994c4405d3c93a4009
SSDEEP

3072:+NsnCygJTh7o+tec2/TQpAm9jtlfGVfuhOViIYn1DalCOe:+NmCygJThk+tedsplfGVfuAibnM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2512	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2512	07262a5c5255f3acdc573c82b5b68ca8.exe
Token: SeLoadDriverPrivilege	2512	07262a5c5255f3acdc573c82b5b68ca8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2972	2512	07262a5c5255f3acdc573c82b5b68ca8.exe	28
PID 2512 wrote to memory of 2972	2512	07262a5c5255f3acdc573c82b5b68ca8.exe	28
PID 2512 wrote to memory of 2972	2512	07262a5c5255f3acdc573c82b5b68ca8.exe	28
PID 2512 wrote to memory of 2972	2512	07262a5c5255f3acdc573c82b5b68ca8.exe	28

C:\Users\Admin\AppData\Local\Temp\07262a5c5255f3acdc573c82b5b68ca8.exe
"C:\Users\Admin\AppData\Local\Temp\07262a5c5255f3acdc573c82b5b68ca8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 52
  2⤵
  - Program crash
  PID:2972

memory/2512-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download