f0df6b1ad229161fa73e1b1eb94c0a631a39556985dcc589ad413ade33c509df

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:50

Target

323727596e0eae71e281a009666d97b3.exe
Size

9KB
MD5

323727596e0eae71e281a009666d97b3
SHA1

9ef9eaa5a43382166ba852bf31c37eb265964080
SHA256

f0df6b1ad229161fa73e1b1eb94c0a631a39556985dcc589ad413ade33c509df
SHA512

a3c2255c70200d2de81e04e5b4bcb15d401756215411a5ae65549f685ce2cc16c96b0297c1535e9d2e0f2ede1870b1089e7b0f895c195463116e38d41fbb7a95
SSDEEP

192:TBksu7zHNQSNeMZZ3793Vnjdwqzu3WVfHViyHB:sHZNeMFFnhwq6mVfHViyH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	323727596e0eae71e281a009666d97b3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2796	2032	323727596e0eae71e281a009666d97b3.exe	28
PID 2032 wrote to memory of 2796	2032	323727596e0eae71e281a009666d97b3.exe	28
PID 2032 wrote to memory of 2796	2032	323727596e0eae71e281a009666d97b3.exe	28

C:\Users\Admin\AppData\Local\Temp\323727596e0eae71e281a009666d97b3.exe
"C:\Users\Admin\AppData\Local\Temp\323727596e0eae71e281a009666d97b3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2032 -s 896
  2⤵
  PID:2796

memory/2032-0-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2032-1-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-2-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download
memory/2032-3-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-4-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download