5e52b00379f4cf5324151e998fc3799cf9d2b708e79c3a868cdb2f4232140cab

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:34

Target

0095f47d4b0b5148f9c97edcfca8a1cf.exe
Size

9KB
MD5

0095f47d4b0b5148f9c97edcfca8a1cf
SHA1

bee219929bba7236f0d5e30f56b1ee515387bfaf
SHA256

5e52b00379f4cf5324151e998fc3799cf9d2b708e79c3a868cdb2f4232140cab
SHA512

6c134da20a3a42315d8ab9fc4ae901776fdc2a9002a76fb77ff262a0771f1faf9274685c53676ddaa26c8b1a50e9074e82005100c3baeba430db9942e945e0a9
SSDEEP

192:0BksuXzHNQyseMZZ3Y93VnjdwqzO3GRm/a:jHFseM0FnhwqCWQ/

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	0095f47d4b0b5148f9c97edcfca8a1cf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2708	2416	0095f47d4b0b5148f9c97edcfca8a1cf.exe	28
PID 2416 wrote to memory of 2708	2416	0095f47d4b0b5148f9c97edcfca8a1cf.exe	28
PID 2416 wrote to memory of 2708	2416	0095f47d4b0b5148f9c97edcfca8a1cf.exe	28

C:\Users\Admin\AppData\Local\Temp\0095f47d4b0b5148f9c97edcfca8a1cf.exe
"C:\Users\Admin\AppData\Local\Temp\0095f47d4b0b5148f9c97edcfca8a1cf.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2416 -s 900
  2⤵
  PID:2708

memory/2416-0-0x0000000001170000-0x0000000001178000-memory.dmp

Filesize
32KB

Download
memory/2416-1-0x000007FEF6280000-0x000007FEF6C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2416-2-0x000000001B380000-0x000000001B400000-memory.dmp

Filesize
512KB

Download
memory/2416-3-0x000007FEF6280000-0x000007FEF6C6C000-memory.dmp

Filesize
9.9MB

Download
memory/2416-4-0x000000001B380000-0x000000001B400000-memory.dmp

Filesize
512KB

Download