6cc2fdcdbe4fb574bb3d655f066b82bcc321852f4084ba573091a23b6eb47d57

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:46

Target

00dd7aeca01101a4a68b87dca6bb3617.exe
Size

9KB
MD5

00dd7aeca01101a4a68b87dca6bb3617
SHA1

26167a2354c5478f227b2d98ddf90b65f8f22c1e
SHA256

6cc2fdcdbe4fb574bb3d655f066b82bcc321852f4084ba573091a23b6eb47d57
SHA512

e111913dbac847a74d99468314d1ba5938b027359d9fdcb863a8652e23ba09162ac8363e74cc20ef626585f487c54d3a7e6dd3f5d1ad73396c0175860842ac07
SSDEEP

192:4BksuLPY82gQv5F4Xt6eMZZ3H93VnjdwCzTh3W+7lF:o82l4Xt6eMhFnhwC/hmol

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	00dd7aeca01101a4a68b87dca6bb3617.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2728	2096	00dd7aeca01101a4a68b87dca6bb3617.exe	28
PID 2096 wrote to memory of 2728	2096	00dd7aeca01101a4a68b87dca6bb3617.exe	28
PID 2096 wrote to memory of 2728	2096	00dd7aeca01101a4a68b87dca6bb3617.exe	28

C:\Users\Admin\AppData\Local\Temp\00dd7aeca01101a4a68b87dca6bb3617.exe
"C:\Users\Admin\AppData\Local\Temp\00dd7aeca01101a4a68b87dca6bb3617.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 904
  2⤵
  PID:2728

memory/2096-0-0x0000000000980000-0x0000000000988000-memory.dmp

Filesize
32KB

Download
memory/2096-1-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-2-0x000000001B290000-0x000000001B310000-memory.dmp

Filesize
512KB

Download
memory/2096-3-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-4-0x000000001B290000-0x000000001B310000-memory.dmp

Filesize
512KB

Download