fce7f03031daf72ffc67f58d7ef9d424fa7212efd83cc90326764af7e45a99c3

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 06:49

Target

1170d1b81c14da907c41a6775a2600ff.exe
Size

9KB
MD5

1170d1b81c14da907c41a6775a2600ff
SHA1

f42a6adf71944e1bfc0a75ffae270e86654598da
SHA256

fce7f03031daf72ffc67f58d7ef9d424fa7212efd83cc90326764af7e45a99c3
SHA512

e674ab5df10c5f89df2dc60fc405e55c8c1d285c63a370b498d7f3296a04a174ab5e4dbe8de1548327a76ef25c2da9af7818100d840ec4a094d8a0487050d6d7
SSDEEP

192:eBksuXzHNQ47eMZZ3J93VnjdwqzR3xb6LIiW:xHr7eMzFnhwqlBb68i

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	1170d1b81c14da907c41a6775a2600ff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1988	2844	1170d1b81c14da907c41a6775a2600ff.exe	30
PID 2844 wrote to memory of 1988	2844	1170d1b81c14da907c41a6775a2600ff.exe	30
PID 2844 wrote to memory of 1988	2844	1170d1b81c14da907c41a6775a2600ff.exe	30

C:\Users\Admin\AppData\Local\Temp\1170d1b81c14da907c41a6775a2600ff.exe
"C:\Users\Admin\AppData\Local\Temp\1170d1b81c14da907c41a6775a2600ff.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2844 -s 904
  2⤵
  PID:1988

memory/2844-0-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/2844-1-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2844-2-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download
memory/2844-3-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2844-4-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download