2a296ae55cc6114a8cccb26df5d5c4824e8fc27ee327a204271106c03202689c

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:00

Target

7774d14e88522623a94c51e709a8a4b7.exe
Size

9KB
MD5

7774d14e88522623a94c51e709a8a4b7
SHA1

557994d109a4780320f8f8a1df975e343d83ac63
SHA256

2a296ae55cc6114a8cccb26df5d5c4824e8fc27ee327a204271106c03202689c
SHA512

b9249bd7485235179dc93113ca088dbfa0f47b3ee9092f99f5247b10fa65383ad8e18e33ffa4f4ad4c9fccfc35d1da7ca53c45bf4040b13be757af01e8ed43ea
SSDEEP

192:MBksuL9MuIYReMZZ3Z93Vnjdwqz337S3b:plRReMLFnhwqre3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	7774d14e88522623a94c51e709a8a4b7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2820	3052	7774d14e88522623a94c51e709a8a4b7.exe	28
PID 3052 wrote to memory of 2820	3052	7774d14e88522623a94c51e709a8a4b7.exe	28
PID 3052 wrote to memory of 2820	3052	7774d14e88522623a94c51e709a8a4b7.exe	28

C:\Users\Admin\AppData\Local\Temp\7774d14e88522623a94c51e709a8a4b7.exe
"C:\Users\Admin\AppData\Local\Temp\7774d14e88522623a94c51e709a8a4b7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3052 -s 900
  2⤵
  PID:2820

memory/3052-0-0x0000000001160000-0x0000000001168000-memory.dmp

Filesize
32KB

Download
memory/3052-1-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-2-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download
memory/3052-3-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-4-0x000000001B3E0000-0x000000001B460000-memory.dmp

Filesize
512KB

Download