5f397374dca8583a084034b2df639957fa34d2948f5ae17c058f5a4863c231ac

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 01:57

Target

4af681a966839bfb794759ee9f773321.exe
Size

959KB
MD5

4af681a966839bfb794759ee9f773321
SHA1

a3c00356cb90d7ce114b51497e07029206986d8a
SHA256

5f397374dca8583a084034b2df639957fa34d2948f5ae17c058f5a4863c231ac
SHA512

f5c839afcb97095cc03a1219d60802f3682263dca4ac798a863d260f52fbab84f614ba6dd0132abe4a8078c95ebdc266756d0d663c8b4f680f32752c3322ca65
SSDEEP

12288:s0NwwQvN6h0jNCumngV2BrfPGeFx0d7+Ss9vVGppB85msez78MIOn+rqkJ/23ltN:s0mrN3NbtFo+N1tLuqI2PFGZr+Z5J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2292	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	4af681a966839bfb794759ee9f773321.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2728	2292	4af681a966839bfb794759ee9f773321.exe	30
PID 2292 wrote to memory of 2728	2292	4af681a966839bfb794759ee9f773321.exe	30
PID 2292 wrote to memory of 2728	2292	4af681a966839bfb794759ee9f773321.exe	30
PID 2292 wrote to memory of 2728	2292	4af681a966839bfb794759ee9f773321.exe	30

C:\Users\Admin\AppData\Local\Temp\4af681a966839bfb794759ee9f773321.exe
"C:\Users\Admin\AppData\Local\Temp\4af681a966839bfb794759ee9f773321.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 19076
  2⤵
  - Program crash
  PID:2728

memory/2292-0-0x00000000009E0000-0x0000000000AD8000-memory.dmp

Filesize
992KB

Download
memory/2292-1-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-2-0x0000000000790000-0x00000000007D0000-memory.dmp

Filesize
256KB

Download
memory/2292-3-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2292-4-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-5-0x0000000000790000-0x00000000007D0000-memory.dmp

Filesize
256KB

Download