b7ddf13f00ea499c874188a93f880f5af216ab5338cb2010a25438edc8cb6e5a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:57

Target

362cd6eaf5e2e5ca2c37b0e6510b7332.exe
Size

9KB
MD5

362cd6eaf5e2e5ca2c37b0e6510b7332
SHA1

bb0289e65d8015fcb21c482ed79ac972e5dfef32
SHA256

b7ddf13f00ea499c874188a93f880f5af216ab5338cb2010a25438edc8cb6e5a
SHA512

38526c157228ebbc6fde16820e940ee80e47b1b6af8daee0a9ae261a2235011d2ff992a881875e0d5c32d447b251b79d531fb6b91d19f9707f9d20487a3c14a6
SSDEEP

192:pBksurzHNQ5ReMZZ3X93Vnjdwqz33/wDr:WHWReMxFnhwqTM

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	362cd6eaf5e2e5ca2c37b0e6510b7332.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3052	1672	362cd6eaf5e2e5ca2c37b0e6510b7332.exe	28
PID 1672 wrote to memory of 3052	1672	362cd6eaf5e2e5ca2c37b0e6510b7332.exe	28
PID 1672 wrote to memory of 3052	1672	362cd6eaf5e2e5ca2c37b0e6510b7332.exe	28

C:\Users\Admin\AppData\Local\Temp\362cd6eaf5e2e5ca2c37b0e6510b7332.exe
"C:\Users\Admin\AppData\Local\Temp\362cd6eaf5e2e5ca2c37b0e6510b7332.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 892
  2⤵
  PID:3052

memory/1672-0-0x0000000001060000-0x0000000001068000-memory.dmp

Filesize
32KB

Download
memory/1672-1-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/1672-2-0x000000001B170000-0x000000001B1F0000-memory.dmp

Filesize
512KB

Download
memory/1672-3-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/1672-4-0x000000001B170000-0x000000001B1F0000-memory.dmp

Filesize
512KB

Download