d4ce222c30767a991b91bc1aa78029e2d1d461c0812cd186f36993436c3b7947

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:38

Target

6b62f82782a3594377cc5468e55fa996.exe
Size

9KB
MD5

6b62f82782a3594377cc5468e55fa996
SHA1

221940e2db100697ddfd45c69efefb7e3e9e3d82
SHA256

d4ce222c30767a991b91bc1aa78029e2d1d461c0812cd186f36993436c3b7947
SHA512

07aaa3a4019464391e973ad16155f36bed7c9709c87e264ab4a9680272fdae1a864c5031dc5c2937fa6516f275909f0954aa969b16febb79dc5522dfce6d6919
SSDEEP

192:2Bksun9MuILxeMZZ3x93VnjdwqzJ3nbi:blWxeM7FnhwqVL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1264	6b62f82782a3594377cc5468e55fa996.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2748	1264	6b62f82782a3594377cc5468e55fa996.exe	28
PID 1264 wrote to memory of 2748	1264	6b62f82782a3594377cc5468e55fa996.exe	28
PID 1264 wrote to memory of 2748	1264	6b62f82782a3594377cc5468e55fa996.exe	28

C:\Users\Admin\AppData\Local\Temp\6b62f82782a3594377cc5468e55fa996.exe
"C:\Users\Admin\AppData\Local\Temp\6b62f82782a3594377cc5468e55fa996.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1264 -s 900
  2⤵
  PID:2748

memory/1264-0-0x0000000000A90000-0x0000000000A98000-memory.dmp

Filesize
32KB

Download
memory/1264-1-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/1264-2-0x0000000000300000-0x0000000000380000-memory.dmp

Filesize
512KB

Download
memory/1264-3-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/1264-4-0x0000000000300000-0x0000000000380000-memory.dmp

Filesize
512KB

Download