144a51e62a55120cf3a521ea8354a8e64f0de0f9b5d03bbefd122d4014afcc2e

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:10

Target

00183fa4837dab9aa4dbf648f6660774.exe
Size

8KB
MD5

00183fa4837dab9aa4dbf648f6660774
SHA1

a7a3f4b84aa793b0bd42b3ac6a2f8b5db4e73674
SHA256

144a51e62a55120cf3a521ea8354a8e64f0de0f9b5d03bbefd122d4014afcc2e
SHA512

89a14471ea931c95d2c251aae530f548a1501357c93866ce0788a506e8de30049f2736fe39318815182d5872bc1887165d9dcd1a6fdab71f3ff6ac82d1c5e18c
SSDEEP

96:VjTVzdERWjxqHLETmqZHzbxilif8KhCF7TCFRCFRCFJCFHCFzCFsCF/YRyU84Rzj:V8WVNmqFbH++4ULz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	936	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	00183fa4837dab9aa4dbf648f6660774.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 3008	936	00183fa4837dab9aa4dbf648f6660774.exe	28
PID 936 wrote to memory of 3008	936	00183fa4837dab9aa4dbf648f6660774.exe	28
PID 936 wrote to memory of 3008	936	00183fa4837dab9aa4dbf648f6660774.exe	28
PID 936 wrote to memory of 3008	936	00183fa4837dab9aa4dbf648f6660774.exe	28

C:\Users\Admin\AppData\Local\Temp\00183fa4837dab9aa4dbf648f6660774.exe
"C:\Users\Admin\AppData\Local\Temp\00183fa4837dab9aa4dbf648f6660774.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 984
  2⤵
  - Program crash
  PID:3008

memory/936-0-0x0000000000C40000-0x0000000000C48000-memory.dmp

Filesize
32KB

Download
memory/936-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/936-2-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/936-3-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/936-4-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download