db9e025c787bd2ca636b8e1fc57abe3d69de792e62b42674ad664d4dcd003fd5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:27

Target

Slurp 15.06 AutoUpdater!/SlurpBootstrapper.exe
Size

11KB
MD5

46bde87641de5afde46d61f3eed68365
SHA1

6f63b329d9f425cc0bf035831dbe6189af7686e5
SHA256

3b16810e51e5e18f1e93c3c3c400fbf0b4b8769391f44582649fa7e9d6cd2a3b
SHA512

32c819c33f86f3dfb29407348bcbd426bda987b611945fc8ff4c30b4711948b49d6df6b52f8bfddf83e469db5258398702506894b18eb4f961c00896755a9ae1
SSDEEP

192:zrJt0D3B6j5+ME1H6zcWdmUBkm5/DfbFLmfW5b:j0Dkj5PEozuV6/DTaW5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2196	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	SlurpBootstrapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	SlurpBootstrapper.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2080	2196	SlurpBootstrapper.exe	29
PID 2196 wrote to memory of 2080	2196	SlurpBootstrapper.exe	29
PID 2196 wrote to memory of 2080	2196	SlurpBootstrapper.exe	29
PID 2196 wrote to memory of 2080	2196	SlurpBootstrapper.exe	29

C:\Users\Admin\AppData\Local\Temp\Slurp 15.06 AutoUpdater!\SlurpBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Slurp 15.06 AutoUpdater!\SlurpBootstrapper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 996
  2⤵
  - Program crash
  PID:2080

memory/2196-1-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-2-0x0000000000B00000-0x0000000000BAA000-memory.dmp

Filesize
680KB

Download
memory/2196-0-0x0000000001170000-0x0000000001178000-memory.dmp

Filesize
32KB

Download
memory/2196-3-0x0000000000E80000-0x0000000000EC0000-memory.dmp

Filesize
256KB

Download
memory/2196-4-0x0000000074150000-0x000000007483E000-memory.dmp

Filesize
6.9MB

Download
memory/2196-5-0x0000000000E80000-0x0000000000EC0000-memory.dmp

Filesize
256KB

Download