577bfeba2c8b5056acc1de9d129221bf0cb101bd2f53ac8c72fe5fdc2fb955a4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:58

Target

09d7be1d7f70b874a12043b85425d53a.exe
Size

7.7MB
MD5

09d7be1d7f70b874a12043b85425d53a
SHA1

7eeaa4fd4badb924f65f0af958d2d3e073dd46ef
SHA256

577bfeba2c8b5056acc1de9d129221bf0cb101bd2f53ac8c72fe5fdc2fb955a4
SHA512

d5a80e389fbee90d1f74b3d975ee42917152d14f2afff1f4729ab3417449c2a778196be7252ddeb3e75c1ef4d56fe8e4f6492196bed0c158cdd7c0a49fa0d4ba
SSDEEP

196608:QgvpdunXbwpYWSLWXTGyrG+US9qkLfMVpwBsWF:TxdicuNGasG+r1gVpwBsC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	2164	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	09d7be1d7f70b874a12043b85425d53a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2732	2164	09d7be1d7f70b874a12043b85425d53a.exe	28
PID 2164 wrote to memory of 2732	2164	09d7be1d7f70b874a12043b85425d53a.exe	28
PID 2164 wrote to memory of 2732	2164	09d7be1d7f70b874a12043b85425d53a.exe	28
PID 2164 wrote to memory of 2732	2164	09d7be1d7f70b874a12043b85425d53a.exe	28

C:\Users\Admin\AppData\Local\Temp\09d7be1d7f70b874a12043b85425d53a.exe
"C:\Users\Admin\AppData\Local\Temp\09d7be1d7f70b874a12043b85425d53a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 2240
  2⤵
  - Program crash
  PID:2732

C:\Users\Admin\AppData\Local\Google_Inc\09d7be1d7f70b874a12043b85_Url_pxdop3g0n4mcrhlkzzo4n2qo5mgaafp3\1.2.3.4\user.config

Filesize
1KB

MD5
3ed6e5c214937fa8d70c11c3cb5cfc89

SHA1
6a486bf17a13cbf38295197a02285cbd0d90e34d

SHA256
fb48fcf7a98ee0d5ed7fcc50f875a91add78bdeeeadfb91dc324ca702bb63368

SHA512
b514da067847dda0029ed251831b79e72533278e3ff4f9787f3ba68b72036c827458369b3c98e211a2faee308ad6cd90dde524db0c10638526fc630a1c7e8a20

Download Submit
memory/2164-0-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/2164-1-0x00000000012E0000-0x0000000001A94000-memory.dmp

Filesize
7.7MB

Download
memory/2164-2-0x0000000008710000-0x0000000008EE6000-memory.dmp

Filesize
7.8MB

Download
memory/2164-3-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2164-4-0x00000000051B0000-0x00000000051F0000-memory.dmp

Filesize
256KB

Download
memory/2164-5-0x00000000051B0000-0x00000000051F0000-memory.dmp

Filesize
256KB

Download
memory/2164-41-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/2164-42-0x00000000051B0000-0x00000000051F0000-memory.dmp

Filesize
256KB

Download
memory/2164-43-0x00000000051B0000-0x00000000051F0000-memory.dmp

Filesize
256KB

Download