1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 14:29

Target

1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe
Size

1.6MB
MD5

f561293db8112dd3e6e4efc950425bb6
SHA1

3507149ddd209a524946ed033b01398111d2e224
SHA256

1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8
SHA512

8740bdad1aa1d9b37d37bb77f6949c035552173631b93aaee66650d903e029f2d24c0a35a4f1016401b79827db2c3e05a41e4ad3ebca70cc856ad6c2b186b707
SSDEEP

24576:uS2r2fUlJc3K9h1d4jWUjsoiGbJ7Bx4lrq4xQkQvwZng3pDgDMDoV1DDxDD+DDQZ:h8o3ehLq/iGV774lrq4fQvwsy

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1064	1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2696	1064	1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe	28
PID 1064 wrote to memory of 2696	1064	1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe	28
PID 1064 wrote to memory of 2696	1064	1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe	28

C:\Users\Admin\AppData\Local\Temp\1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe
"C:\Users\Admin\AppData\Local\Temp\1888a561be2918748c0965153dc8bbd56104a0dd4f5f7a73e9c6ade673f3c0f8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1064 -s 1016
  2⤵
  PID:2696

memory/1064-8-0x000000001AD80000-0x000000001AE00000-memory.dmp

Filesize
512KB

Download
memory/1064-4-0x000000001AD80000-0x000000001AE00000-memory.dmp

Filesize
512KB

Download
memory/1064-3-0x000000001AD80000-0x000000001AE00000-memory.dmp

Filesize
512KB

Download
memory/1064-2-0x000000001AD80000-0x000000001AE00000-memory.dmp

Filesize
512KB

Download
memory/1064-1-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/1064-0-0x0000000001CA0000-0x0000000001CE8000-memory.dmp

Filesize
288KB

Download
memory/1064-9-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download