d48c67310ff1c4e11b513137bc2ac912ce80e76c566c1e6f4592e5230516463b

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 16:25

Target

7c81516fd0372a99c36899d9d3f1cd42.exe
Size

109KB
MD5

7c81516fd0372a99c36899d9d3f1cd42
SHA1

23d634201811dcf16178f6b3b958128c9c561b70
SHA256

d48c67310ff1c4e11b513137bc2ac912ce80e76c566c1e6f4592e5230516463b
SHA512

9ed18f2d6c784dadbdef778975c1d1ff01cbedcc157337cc0e2a8804fb5ead96dc91813a6cd8cea7db92485919e7fa2c5de45ce676e518f9cb13a51accab35ec
SSDEEP

1536:jcqrQ45YHwTK8JzDGBktaHIrubcCwijNM/fYt3IO2Kt:rF5xe8JzDGCfu+AaQdI6t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	2488	WerFault.exe	13

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	7c81516fd0372a99c36899d9d3f1cd42.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2036	2488	7c81516fd0372a99c36899d9d3f1cd42.exe	28
PID 2488 wrote to memory of 2036	2488	7c81516fd0372a99c36899d9d3f1cd42.exe	28
PID 2488 wrote to memory of 2036	2488	7c81516fd0372a99c36899d9d3f1cd42.exe	28
PID 2488 wrote to memory of 2036	2488	7c81516fd0372a99c36899d9d3f1cd42.exe	28

C:\Users\Admin\AppData\Local\Temp\7c81516fd0372a99c36899d9d3f1cd42.exe
"C:\Users\Admin\AppData\Local\Temp\7c81516fd0372a99c36899d9d3f1cd42.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 292
  2⤵
  - Program crash
  PID:2036

memory/2488-0-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download