b5b2758599caa748a73bba034c51ee76403005a6f39b530450326de088e5447c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 08:58

Target

13e7ee2379f739bcdf874407ff4f8ecb.exe
Size

9KB
MD5

13e7ee2379f739bcdf874407ff4f8ecb
SHA1

e4c13dfdacd7e370bebab611b5e1cd035d05cb8f
SHA256

b5b2758599caa748a73bba034c51ee76403005a6f39b530450326de088e5447c
SHA512

837c5b3150a37e2aa32197dd168f5d79496abe0f70116e771d77c93503de5cc5954d2fa2694df14da5ef874b0c0edb46a4cc07515392d7320ba69e08b2ccb1d8
SSDEEP

192:ZBksuzPY82gQv5F4wtCeMZZ3L93VnjdwCz773S+1:382l4wtCeMFFnhwCrC+

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	13e7ee2379f739bcdf874407ff4f8ecb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2776	2052	13e7ee2379f739bcdf874407ff4f8ecb.exe	28
PID 2052 wrote to memory of 2776	2052	13e7ee2379f739bcdf874407ff4f8ecb.exe	28
PID 2052 wrote to memory of 2776	2052	13e7ee2379f739bcdf874407ff4f8ecb.exe	28

C:\Users\Admin\AppData\Local\Temp\13e7ee2379f739bcdf874407ff4f8ecb.exe
"C:\Users\Admin\AppData\Local\Temp\13e7ee2379f739bcdf874407ff4f8ecb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2052 -s 892
  2⤵
  PID:2776

memory/2052-0-0x0000000000120000-0x0000000000128000-memory.dmp

Filesize
32KB

Download
memory/2052-1-0x000007FEF6070000-0x000007FEF6A5C000-memory.dmp

Filesize
9.9MB

Download
memory/2052-2-0x0000000000620000-0x00000000006A0000-memory.dmp

Filesize
512KB

Download
memory/2052-3-0x000007FEF6070000-0x000007FEF6A5C000-memory.dmp

Filesize
9.9MB

Download
memory/2052-4-0x0000000000620000-0x00000000006A0000-memory.dmp

Filesize
512KB

Download