5fabb2bb7a4b5d30e340ee071663d9e221bc6ba3328cf13368996051c9d67721

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-12-2023 09:11

Target

abd27e2a444507435b20c67464936014.exe
Size

21KB
MD5

abd27e2a444507435b20c67464936014
SHA1

2b9daae5133ce4b4757b1a0a9a7d5b52d0f6611e
SHA256

5fabb2bb7a4b5d30e340ee071663d9e221bc6ba3328cf13368996051c9d67721
SHA512

4555dbf2c9066d0bbed9f72bf9ac56ffbe409839669d5be38efe436bb32dc760f17d57c455ff74b394f7aefabd8872a9e52c036e1005e4447d0d5e7beb0a6750
SSDEEP

384:Iv4dxX5EOddFNuYd79l+JUUo+BoUy5i8Y/TIC/TaQ:IgTeOddFkYd79cJUUo+qRDYrPuQ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

abd27e2a444507435b20c67464936014.exe

description pid process

Token: SeDebugPrivilege 2100 abd27e2a444507435b20c67464936014.exe

description	pid	process
Token: SeDebugPrivilege	2100	abd27e2a444507435b20c67464936014.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

abd27e2a444507435b20c67464936014.exe

description	pid	process	target process
PID 2100 wrote to memory of 1988	2100	abd27e2a444507435b20c67464936014.exe	WerFault.exe
PID 2100 wrote to memory of 1988	2100	abd27e2a444507435b20c67464936014.exe	WerFault.exe
PID 2100 wrote to memory of 1988	2100	abd27e2a444507435b20c67464936014.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2100 -s 968
2⤵
PID:1988

memory/2100-0-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Filesize
48KB

Download
memory/2100-1-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2100-2-0x00000000003D0000-0x0000000000450000-memory.dmp

Filesize
512KB

Download
memory/2100-3-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2100-4-0x00000000003D0000-0x0000000000450000-memory.dmp

Filesize
512KB

Download