0821ca98c306c5ac791e7fb80d81e5f8dc7d49f3bd88935561c1bc0d70821674

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 10:20

Target

16c23beea2ed64892ae33e3214dcd22e.exe
Size

22KB
MD5

16c23beea2ed64892ae33e3214dcd22e
SHA1

dc3a74fb3723160a2b80fd7adb6cc006b84f3c04
SHA256

0821ca98c306c5ac791e7fb80d81e5f8dc7d49f3bd88935561c1bc0d70821674
SHA512

cda51458e2f038ed8e03af4dad324866428f439b086ba7d5bd6f843d6d0aa91fa5294ccde00d7bbd331c5242ffec5bdf8f5b17c0594bbe4bcd3e0378145ff8dd
SSDEEP

384:I9azLT4M+GdozOWeLYRJkE6SesUynJ8Y/TISQk:IDM+GdozOWeLYR+EJPqYrz

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16c23beea2ed64892ae33e3214dcd22e.exe

description pid process

Token: SeDebugPrivilege 2124 16c23beea2ed64892ae33e3214dcd22e.exe

description	pid	process
Token: SeDebugPrivilege	2124	16c23beea2ed64892ae33e3214dcd22e.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

16c23beea2ed64892ae33e3214dcd22e.exe

description	pid	process	target process
PID 2124 wrote to memory of 2684	2124	16c23beea2ed64892ae33e3214dcd22e.exe	WerFault.exe
PID 2124 wrote to memory of 2684	2124	16c23beea2ed64892ae33e3214dcd22e.exe	WerFault.exe
PID 2124 wrote to memory of 2684	2124	16c23beea2ed64892ae33e3214dcd22e.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2124 -s 964
2⤵
PID:2684

memory/2124-0-0x00000000010A0000-0x00000000010AC000-memory.dmp

Filesize
48KB

Download
memory/2124-1-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-2-0x00000000005B0000-0x0000000000630000-memory.dmp

Filesize
512KB

Download
memory/2124-3-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-4-0x00000000005B0000-0x0000000000630000-memory.dmp

Filesize
512KB

Download