32cd7715d777f594ab17bd236aed6e98ae373bf612a5b1ee037c6929f2a5a2da

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:54

Target

5826e89b47e34e96469d54f85c09d206.exe
Size

9KB
MD5

5826e89b47e34e96469d54f85c09d206
SHA1

6c9e4198b270d38fb1287a9fc8c90931f4b7eca1
SHA256

32cd7715d777f594ab17bd236aed6e98ae373bf612a5b1ee037c6929f2a5a2da
SHA512

737404cb51b35e00f43bef298cdf9228deada724acb4005c1ee84c82d5fe751e60d8a56f56678a584250ce3b57d653be1745a3c941b7353cf54cc6ed2d394d00
SSDEEP

192:BBksunPY82gQv5F4zt2eMZZ3n93VnjdwCz03LzHND:T82l4zt2eM5FnhwCQvHN

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	5826e89b47e34e96469d54f85c09d206.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2668	2400	5826e89b47e34e96469d54f85c09d206.exe	28
PID 2400 wrote to memory of 2668	2400	5826e89b47e34e96469d54f85c09d206.exe	28
PID 2400 wrote to memory of 2668	2400	5826e89b47e34e96469d54f85c09d206.exe	28

C:\Users\Admin\AppData\Local\Temp\5826e89b47e34e96469d54f85c09d206.exe
"C:\Users\Admin\AppData\Local\Temp\5826e89b47e34e96469d54f85c09d206.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2400 -s 896
  2⤵
  PID:2668

memory/2400-0-0x0000000000150000-0x0000000000158000-memory.dmp

Filesize
32KB

Download
memory/2400-1-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2400-2-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download
memory/2400-3-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2400-4-0x000000001B0A0000-0x000000001B120000-memory.dmp

Filesize
512KB

Download