70207d9ff00977c2deebb377862fa6e74c50b1b2980f24f4b18b8f6e2ce2ad88

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 14:15

Target

24b0926f343e10b2fd2d6a70a69dac7b.exe
Size

9KB
MD5

24b0926f343e10b2fd2d6a70a69dac7b
SHA1

14323238300b1635769f2b1fa67e65caf6782693
SHA256

70207d9ff00977c2deebb377862fa6e74c50b1b2980f24f4b18b8f6e2ce2ad88
SHA512

7d52f9d0102090a7c644269847a55c27735471787b5b45ee20509eef09e482f1aa036e7a4fa06501db9a08dae7a13413e68a2265ed00292af52254c30285bb02
SSDEEP

192:rBksuXEXVwVrGeMZZ3T93VnjdwCzh3g1ZojCh:xVwRGeM1FnhwClQfojC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	24b0926f343e10b2fd2d6a70a69dac7b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3016	2356	24b0926f343e10b2fd2d6a70a69dac7b.exe	28
PID 2356 wrote to memory of 3016	2356	24b0926f343e10b2fd2d6a70a69dac7b.exe	28
PID 2356 wrote to memory of 3016	2356	24b0926f343e10b2fd2d6a70a69dac7b.exe	28

C:\Users\Admin\AppData\Local\Temp\24b0926f343e10b2fd2d6a70a69dac7b.exe
"C:\Users\Admin\AppData\Local\Temp\24b0926f343e10b2fd2d6a70a69dac7b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2356 -s 892
  2⤵
  PID:3016

memory/2356-0-0x0000000001190000-0x0000000001198000-memory.dmp

Filesize
32KB

Download
memory/2356-1-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2356-2-0x000000001B6B0000-0x000000001B730000-memory.dmp

Filesize
512KB

Download
memory/2356-3-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

Filesize
9.9MB

Download
memory/2356-4-0x000000001B6B0000-0x000000001B730000-memory.dmp

Filesize
512KB

Download