3c718ea531a45fbf443d687afaff16ca75a4f93031335004042ca8b8ff49088c

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:31

Target

01cc2ecdd58f42c990762add7840b136.exe
Size

9KB
MD5

01cc2ecdd58f42c990762add7840b136
SHA1

17417e487d92c853cc0d417993ee1b14b26c58ca
SHA256

3c718ea531a45fbf443d687afaff16ca75a4f93031335004042ca8b8ff49088c
SHA512

594030dc67208e39a789601c34ca779a199b9830ac3d9c58644ea3585ff9efc6cf6fca42dcaab76b10f0b02e84a47daa618130e3ce3ee07fad4f61f7ae293590
SSDEEP

192:P32tbH6kdiUD3eUMwlgaoZZRDTbKEJ+6Syp:PGZak7ThPgaoZZ9TbKt6h

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1464	2032	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	01cc2ecdd58f42c990762add7840b136.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1464	2032	01cc2ecdd58f42c990762add7840b136.exe	29
PID 2032 wrote to memory of 1464	2032	01cc2ecdd58f42c990762add7840b136.exe	29
PID 2032 wrote to memory of 1464	2032	01cc2ecdd58f42c990762add7840b136.exe	29
PID 2032 wrote to memory of 1464	2032	01cc2ecdd58f42c990762add7840b136.exe	29

C:\Users\Admin\AppData\Local\Temp\01cc2ecdd58f42c990762add7840b136.exe
"C:\Users\Admin\AppData\Local\Temp\01cc2ecdd58f42c990762add7840b136.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 580
  2⤵
  - Program crash
  PID:1464

memory/2032-0-0x0000000000970000-0x0000000000978000-memory.dmp

Filesize
32KB

Download
memory/2032-1-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2032-2-0x0000000002010000-0x0000000002050000-memory.dmp

Filesize
256KB

Download
memory/2032-3-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2032-4-0x0000000002010000-0x0000000002050000-memory.dmp

Filesize
256KB

Download