671d4af70879644a4d36c698284f847d9e88a002fe7ea6213cadd7596625a9df

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:59

Target

1dd5240b307e78c934372b27f1fbec8c.exe
Size

9KB
MD5

1dd5240b307e78c934372b27f1fbec8c
SHA1

28146441bcffbce9b8a42d05a3e158ac3c4bedaa
SHA256

671d4af70879644a4d36c698284f847d9e88a002fe7ea6213cadd7596625a9df
SHA512

8bb7009ffbcc659596ab80bf95fc0ab7c97a8f02b2d2f99a498254e73a5b09a16bb56c4edf980d70bfc308e8ecaa3b3a10232ea9da0920a4b26c399eac343e46
SSDEEP

192:DBksu7rN3y+MUeMZZ3P93VnjdwCzJ3OLQ6Q:IZmUeMxFnhwCFQR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	1dd5240b307e78c934372b27f1fbec8c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2836	2980	1dd5240b307e78c934372b27f1fbec8c.exe	28
PID 2980 wrote to memory of 2836	2980	1dd5240b307e78c934372b27f1fbec8c.exe	28
PID 2980 wrote to memory of 2836	2980	1dd5240b307e78c934372b27f1fbec8c.exe	28

C:\Users\Admin\AppData\Local\Temp\1dd5240b307e78c934372b27f1fbec8c.exe
"C:\Users\Admin\AppData\Local\Temp\1dd5240b307e78c934372b27f1fbec8c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2980 -s 892
  2⤵
  PID:2836

memory/2980-0-0x0000000001300000-0x0000000001308000-memory.dmp

Filesize
32KB

Download
memory/2980-1-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Filesize
9.9MB

Download
memory/2980-2-0x0000000001200000-0x0000000001280000-memory.dmp

Filesize
512KB

Download
memory/2980-3-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Filesize
9.9MB

Download
memory/2980-4-0x0000000001200000-0x0000000001280000-memory.dmp

Filesize
512KB

Download