b120c54e89436431f3f9f68720a0bd08896025d8abd77b9f91181c4227eda538

Analysis

max time kernel
55s
max time network
78s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:32

Target

149863be27d1d6c2006fcb370e6573f7.exe
Size

9KB
MD5

149863be27d1d6c2006fcb370e6573f7
SHA1

4fa6faa485270ada6375e5f128b60362f56e041c
SHA256

b120c54e89436431f3f9f68720a0bd08896025d8abd77b9f91181c4227eda538
SHA512

7cc60e10e6bfd8ee382579a4765266bbfce99d0902e590501577c399d1a1998ac5f867361e1f58487932e2cd7d54eeee498f075476d3e5729acdaab75c193ebf
SSDEEP

192:HBksurzHNQRUeMZZ3493Vnjdwqzv3zI2m:QH2UeM8Fnhwqrc2

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	149863be27d1d6c2006fcb370e6573f7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2596	2780	149863be27d1d6c2006fcb370e6573f7.exe	29
PID 2780 wrote to memory of 2596	2780	149863be27d1d6c2006fcb370e6573f7.exe	29
PID 2780 wrote to memory of 2596	2780	149863be27d1d6c2006fcb370e6573f7.exe	29

C:\Users\Admin\AppData\Local\Temp\149863be27d1d6c2006fcb370e6573f7.exe
"C:\Users\Admin\AppData\Local\Temp\149863be27d1d6c2006fcb370e6573f7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2780 -s 904
  2⤵
  PID:2596

memory/2780-0-0x0000000000BE0000-0x0000000000BE8000-memory.dmp

Filesize
32KB

Download
memory/2780-1-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/2780-2-0x000000001A630000-0x000000001A6B0000-memory.dmp

Filesize
512KB

Download
memory/2780-3-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

Filesize
9.9MB

Download
memory/2780-4-0x000000001A630000-0x000000001A6B0000-memory.dmp

Filesize
512KB

Download