b9cb59244ae380b87c41822802fe472bbab263e701339ce83a3d3896fbbda8d2

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:51

Target

19116e822e8178fc103e51fe18c825a4.exe
Size

34KB
MD5

19116e822e8178fc103e51fe18c825a4
SHA1

f590a8f1b2f337864b166d8ce53a53e77089135b
SHA256

b9cb59244ae380b87c41822802fe472bbab263e701339ce83a3d3896fbbda8d2
SHA512

3eff84d1dd5fd3fb162e25d2e8d7f3ccb12d408ec3cf18c9e644ca3a8b87b5a29e9c0a0726f929efb890fe8c9cff3a89709dc3f32a047ae1eda18296bd20c271
SSDEEP

768:fMjB/JpMfHDWqpuXDvod3UmQmv4acY2GS2C9xjwhU:UFQlpSDvoJrbvUfGS2q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2012	WerFault.exe	14

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	19116e822e8178fc103e51fe18c825a4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2784	2012	19116e822e8178fc103e51fe18c825a4.exe	28
PID 2012 wrote to memory of 2784	2012	19116e822e8178fc103e51fe18c825a4.exe	28
PID 2012 wrote to memory of 2784	2012	19116e822e8178fc103e51fe18c825a4.exe	28
PID 2012 wrote to memory of 2784	2012	19116e822e8178fc103e51fe18c825a4.exe	28

C:\Users\Admin\AppData\Local\Temp\19116e822e8178fc103e51fe18c825a4.exe
"C:\Users\Admin\AppData\Local\Temp\19116e822e8178fc103e51fe18c825a4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 972
  2⤵
  - Program crash
  PID:2784

memory/2012-0-0x0000000000B00000-0x0000000000B0E000-memory.dmp

Filesize
56KB

Download
memory/2012-1-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2012-2-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

Filesize
256KB

Download
memory/2012-4-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2012-5-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

Filesize
256KB

Download