e20691f62e724a53b99308cd37e3417c2713313cd7a9594b69f7a8557fb0cae8

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:09

Target

3362d55b9c5e3ec545c489e142623b37.exe
Size

9KB
MD5

3362d55b9c5e3ec545c489e142623b37
SHA1

9e1153e9966cca721ab3dd9913e7b73e26691892
SHA256

e20691f62e724a53b99308cd37e3417c2713313cd7a9594b69f7a8557fb0cae8
SHA512

18945608a87ae8589d115c027ab41ea640976995b640b49d75867c4dbbbc7adfa5080e5b81139fe09a071ee762602f3e40309ed5222d0432cab78320d51470f4
SSDEEP

192:EBksu3PY82gQv5F4CtDeMZZ3U93VnjdwCzj3p5Cnn:A82l4CtDeMoFnhwCHHCn

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	3362d55b9c5e3ec545c489e142623b37.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2760	2368	3362d55b9c5e3ec545c489e142623b37.exe	28
PID 2368 wrote to memory of 2760	2368	3362d55b9c5e3ec545c489e142623b37.exe	28
PID 2368 wrote to memory of 2760	2368	3362d55b9c5e3ec545c489e142623b37.exe	28

C:\Users\Admin\AppData\Local\Temp\3362d55b9c5e3ec545c489e142623b37.exe
"C:\Users\Admin\AppData\Local\Temp\3362d55b9c5e3ec545c489e142623b37.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 900
  2⤵
  PID:2760

memory/2368-0-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/2368-1-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-2-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download
memory/2368-3-0x000007FEF60F0000-0x000007FEF6ADC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-4-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download