3bcaa928533ae452f8a3d052d165eff24289cbde9283c54f90a206403f0b1a1d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:41

Target

4a15bccc6eb292982e32a18ab10b520c.exe
Size

88KB
MD5

4a15bccc6eb292982e32a18ab10b520c
SHA1

bed9316b082f62ee15a473a1fcca922c055b2833
SHA256

3bcaa928533ae452f8a3d052d165eff24289cbde9283c54f90a206403f0b1a1d
SHA512

0f07669d2416d842f00714c081422cac061f01e5ccfbc33eaf05e5ac9c6434e9d4edeee0ef355c9b84de5e193fcb1444084bb096f5a17a00e45c27ab9257b1f4
SSDEEP

1536:ZexK+2H3td9lWixUP4VQpiphWQYjpHScmASqVF+nk+ml+9w8:gK+279siU4Cg8mkVF+k/8

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	4a15bccc6eb292982e32a18ab10b520c.exe
1540	4a15bccc6eb292982e32a18ab10b520c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	4a15bccc6eb292982e32a18ab10b520c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2072	1540	4a15bccc6eb292982e32a18ab10b520c.exe	28
PID 1540 wrote to memory of 2072	1540	4a15bccc6eb292982e32a18ab10b520c.exe	28
PID 1540 wrote to memory of 2072	1540	4a15bccc6eb292982e32a18ab10b520c.exe	28

C:\Users\Admin\AppData\Local\Temp\4a15bccc6eb292982e32a18ab10b520c.exe
"C:\Users\Admin\AppData\Local\Temp\4a15bccc6eb292982e32a18ab10b520c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1540 -s 520
  2⤵
  PID:2072

memory/1540-0-0x000000013F290000-0x000000013F2AA000-memory.dmp

Filesize
104KB

Download
memory/1540-1-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/1540-2-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download