357bb601ab1edc684480fefb40bfc9294aa21df2cd216250a930b710452a46e6

Analysis

max time kernel
120s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:52

Target

1676b56e4b18a35129103d5b107f5df4.exe
Size

9KB
MD5

1676b56e4b18a35129103d5b107f5df4
SHA1

0751bb19f84cd4dc03448d256c36888fb1857ebe
SHA256

357bb601ab1edc684480fefb40bfc9294aa21df2cd216250a930b710452a46e6
SHA512

5a4fc88a4545e6afe23455e8d930bf4ed422612c0817956b4105cc472222c05aabc9e7eac235cf2a89fad386d209cf68c106a9bcb61fd9cff2b028e83e8fee3c
SSDEEP

192:kBksuzPY82gQv5F4ZtpeMZZ3i93VnjdwCz8306VQy:082l4ZtpeMGFnhwCYE6VQ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	1676b56e4b18a35129103d5b107f5df4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2536	2696	1676b56e4b18a35129103d5b107f5df4.exe	29
PID 2696 wrote to memory of 2536	2696	1676b56e4b18a35129103d5b107f5df4.exe	29
PID 2696 wrote to memory of 2536	2696	1676b56e4b18a35129103d5b107f5df4.exe	29

C:\Users\Admin\AppData\Local\Temp\1676b56e4b18a35129103d5b107f5df4.exe
"C:\Users\Admin\AppData\Local\Temp\1676b56e4b18a35129103d5b107f5df4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2696 -s 896
  2⤵
  PID:2536

memory/2696-0-0x00000000009F0000-0x00000000009F8000-memory.dmp

Filesize
32KB

Download
memory/2696-1-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/2696-2-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

Filesize
9.9MB

Download
memory/2696-3-0x000000001B5A0000-0x000000001B620000-memory.dmp

Filesize
512KB

Download
memory/2696-4-0x000000001B5A0000-0x000000001B620000-memory.dmp

Filesize
512KB

Download