d214d6cfaf13d8a4681bfb5296c0d4fc01488a52440495bf5ba5495b04b49a54

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:41

Target

513826fe77100f47c60534d310685b90.exe
Size

9KB
MD5

513826fe77100f47c60534d310685b90
SHA1

cb14034b83804a9a0e5be53ce7341e4297794991
SHA256

d214d6cfaf13d8a4681bfb5296c0d4fc01488a52440495bf5ba5495b04b49a54
SHA512

843a36e2949dfa0f891427a2b2a0db96d30230d3d7e49ec6ab95b665d3d155415919222d4fd434146a9f058e6f0c747bfe38f3d71fadcbc5483e694db9bfe5e3
SSDEEP

192:EBksuDrN3y+ISZleMZZ3w93VnjdwCz1S3WfhTnh8I:nZDleMcFnhwC5SmfhTnh

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	513826fe77100f47c60534d310685b90.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2744	2120	513826fe77100f47c60534d310685b90.exe	29
PID 2120 wrote to memory of 2744	2120	513826fe77100f47c60534d310685b90.exe	29
PID 2120 wrote to memory of 2744	2120	513826fe77100f47c60534d310685b90.exe	29

C:\Users\Admin\AppData\Local\Temp\513826fe77100f47c60534d310685b90.exe
"C:\Users\Admin\AppData\Local\Temp\513826fe77100f47c60534d310685b90.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2120 -s 900
  2⤵
  PID:2744

memory/2120-0-0x00000000013C0000-0x00000000013C8000-memory.dmp

Filesize
32KB

Download
memory/2120-1-0x000007FEF5AC0000-0x000007FEF64AC000-memory.dmp

Filesize
9.9MB

Download
memory/2120-2-0x000000001B280000-0x000000001B300000-memory.dmp

Filesize
512KB

Download
memory/2120-3-0x000007FEF5AC0000-0x000007FEF64AC000-memory.dmp

Filesize
9.9MB

Download
memory/2120-4-0x000000001B280000-0x000000001B300000-memory.dmp

Filesize
512KB

Download