c8afdcc52a5bfb0f0296ea592b123bd3c9b0ae884464e22b89d56952e700c011

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:33

Target

149bf05ba263c95c33c4603b5b1b0e4d.exe
Size

617KB
MD5

149bf05ba263c95c33c4603b5b1b0e4d
SHA1

196dddad4ac939d379c3ddc4ff4ccd025edfcfc8
SHA256

c8afdcc52a5bfb0f0296ea592b123bd3c9b0ae884464e22b89d56952e700c011
SHA512

91cd48484073439e9f2de4fb61f31a9980cf1e9ea7346395b6981435e19f5277fb6649ce717ab8c944ccd005faf587e3c936fde5ab5081b0b64e7f75d5320fb5
SSDEEP

12288:txd2ksILL1VtQK2qBXMCcMf65zm3ltQbJLG/WI4eWfF7N3dL:N7sIL3MqBcWf65zm3l2wJ4dN3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	149bf05ba263c95c33c4603b5b1b0e4d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2780	2124	149bf05ba263c95c33c4603b5b1b0e4d.exe	28
PID 2124 wrote to memory of 2780	2124	149bf05ba263c95c33c4603b5b1b0e4d.exe	28
PID 2124 wrote to memory of 2780	2124	149bf05ba263c95c33c4603b5b1b0e4d.exe	28

C:\Users\Admin\AppData\Local\Temp\149bf05ba263c95c33c4603b5b1b0e4d.exe
"C:\Users\Admin\AppData\Local\Temp\149bf05ba263c95c33c4603b5b1b0e4d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2124 -s 92300
  2⤵
  PID:2780

memory/2124-0-0x0000000000090000-0x0000000000134000-memory.dmp

Filesize
656KB

Download
memory/2124-1-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-2-0x0000000000170000-0x0000000000192000-memory.dmp

Filesize
136KB

Download
memory/2124-3-0x000000001ADA0000-0x000000001AE20000-memory.dmp

Filesize
512KB

Download
memory/2124-4-0x0000000002050000-0x00000000020E2000-memory.dmp

Filesize
584KB

Download
memory/2124-5-0x00000000002A0000-0x00000000002D4000-memory.dmp

Filesize
208KB

Download
memory/2124-6-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/2124-7-0x0000000000500000-0x0000000000506000-memory.dmp

Filesize
24KB

Download
memory/2124-8-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-9-0x000000001ADA0000-0x000000001AE20000-memory.dmp

Filesize
512KB

Download