e06e489a6707493ba517a2fd89d85a91c5e0bf4680f7ff267a2f311d75c2c720

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 19:34

Target

385324cacfcaef400347314898c9eaa4.exe
Size

232KB
MD5

385324cacfcaef400347314898c9eaa4
SHA1

ede786cf706939a5bb36e9662bf3e3965b2423cb
SHA256

e06e489a6707493ba517a2fd89d85a91c5e0bf4680f7ff267a2f311d75c2c720
SHA512

75b8cae4cc7dee42c4b74d0fa624b119152f5e58bc4961811254d320d6227b5c4f8835988b695cbae8bcfacbed159a638528f6a7d2bc5a7235d58c509a48c49a
SSDEEP

6144:68bxtopEEIfM2AjZBe9/ZtRqjrdnkUzIRQWqlKbI+/FWH:68bHoxIUrDqhtw5kQS+Mt/YH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2436	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2436	385324cacfcaef400347314898c9eaa4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2116	2436	385324cacfcaef400347314898c9eaa4.exe	28
PID 2436 wrote to memory of 2116	2436	385324cacfcaef400347314898c9eaa4.exe	28
PID 2436 wrote to memory of 2116	2436	385324cacfcaef400347314898c9eaa4.exe	28
PID 2436 wrote to memory of 2116	2436	385324cacfcaef400347314898c9eaa4.exe	28

C:\Users\Admin\AppData\Local\Temp\385324cacfcaef400347314898c9eaa4.exe
"C:\Users\Admin\AppData\Local\Temp\385324cacfcaef400347314898c9eaa4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 56
  2⤵
  - Program crash
  PID:2116

memory/2436-0-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download