5da185f4dab9574cec79ef86a60d3e30df9bd1aad4cb4dda7ca7f1a0511e8d88

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:52

Target

55b01f6d56e352a910fa044d69eb77e3.exe
Size

9KB
MD5

55b01f6d56e352a910fa044d69eb77e3
SHA1

9810a82373fa68cca448f597426d7e5e58404b9f
SHA256

5da185f4dab9574cec79ef86a60d3e30df9bd1aad4cb4dda7ca7f1a0511e8d88
SHA512

ae44b0e182cffab62a307a075844ca9050641a9cac71a646c78597e3a023b789ceca41daa0ba9240d474ec7586c0470def3e33ba85a4ad32acd3bd452333a245
SSDEEP

192:RBksuz9MuIgheMZZ3d93VnjdwqzcJ37u2/zVOc5a:mlhheMXFnhwqMru2/zVx5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	55b01f6d56e352a910fa044d69eb77e3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2556	1216	55b01f6d56e352a910fa044d69eb77e3.exe	28
PID 1216 wrote to memory of 2556	1216	55b01f6d56e352a910fa044d69eb77e3.exe	28
PID 1216 wrote to memory of 2556	1216	55b01f6d56e352a910fa044d69eb77e3.exe	28

C:\Users\Admin\AppData\Local\Temp\55b01f6d56e352a910fa044d69eb77e3.exe
"C:\Users\Admin\AppData\Local\Temp\55b01f6d56e352a910fa044d69eb77e3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1216 -s 892
  2⤵
  PID:2556

memory/1216-0-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download
memory/1216-1-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/1216-2-0x000000001AF60000-0x000000001AFE0000-memory.dmp

Filesize
512KB

Download
memory/1216-3-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/1216-4-0x000000001AF60000-0x000000001AFE0000-memory.dmp

Filesize
512KB

Download