d43018090ab9fbc060dae5d0f246efa3a7fba90c04e19647333736e7f0f7678e

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:31

Target

1d162fe9517675911e9eb7fb667bcdf6.exe
Size

9KB
MD5

1d162fe9517675911e9eb7fb667bcdf6
SHA1

2eeff3f524286bfa17b5830bc2135cae65142227
SHA256

d43018090ab9fbc060dae5d0f246efa3a7fba90c04e19647333736e7f0f7678e
SHA512

128c41ff23dcf44b0a22e421e0b9f468625be0576b7872c2259b36239a481e599d900f0a82267f7540a85cad3f4af753ac782fa246a6d1234fbcc205591e64e7
SSDEEP

192:zBksu7rN3y+KxeMZZ3U93VnjdwCz93vk9ik:YZoxeM4FnhwCZfk9i

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	1d162fe9517675911e9eb7fb667bcdf6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3020	2108	1d162fe9517675911e9eb7fb667bcdf6.exe	28
PID 2108 wrote to memory of 3020	2108	1d162fe9517675911e9eb7fb667bcdf6.exe	28
PID 2108 wrote to memory of 3020	2108	1d162fe9517675911e9eb7fb667bcdf6.exe	28

C:\Users\Admin\AppData\Local\Temp\1d162fe9517675911e9eb7fb667bcdf6.exe
"C:\Users\Admin\AppData\Local\Temp\1d162fe9517675911e9eb7fb667bcdf6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 896
  2⤵
  PID:3020

memory/2108-0-0x0000000001070000-0x0000000001078000-memory.dmp

Filesize
32KB

Download
memory/2108-1-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2108-2-0x0000000000C80000-0x0000000000D00000-memory.dmp

Filesize
512KB

Download
memory/2108-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2108-4-0x0000000000C80000-0x0000000000D00000-memory.dmp

Filesize
512KB

Download