4e8431951f9db63878ab809f3679a7d64ff3b6294fe84b0658a9f342136e9774

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:48

Target

223739e504ca07d3d57d60b80c724025.exe
Size

9KB
MD5

223739e504ca07d3d57d60b80c724025
SHA1

e726d4060695e8373f7a10c5b8ce8aef49072da6
SHA256

4e8431951f9db63878ab809f3679a7d64ff3b6294fe84b0658a9f342136e9774
SHA512

a20e8aaa91a11db620d6edb7003dc3b661957b5db9a33061b0d81b4259a3d2cb6f507e93b55b2db117552185a61ea9c65682baee8d479c960e9c7cd27ccdef36
SSDEEP

192:hBksuPrN3y+JOeMZZ3J93VnjdwCzmU3w9w:uZHOeMTFnhwCLg9

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	223739e504ca07d3d57d60b80c724025.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2824	2232	223739e504ca07d3d57d60b80c724025.exe	28
PID 2232 wrote to memory of 2824	2232	223739e504ca07d3d57d60b80c724025.exe	28
PID 2232 wrote to memory of 2824	2232	223739e504ca07d3d57d60b80c724025.exe	28

C:\Users\Admin\AppData\Local\Temp\223739e504ca07d3d57d60b80c724025.exe
"C:\Users\Admin\AppData\Local\Temp\223739e504ca07d3d57d60b80c724025.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 892
  2⤵
  PID:2824

memory/2232-0-0x0000000000A80000-0x0000000000A88000-memory.dmp

Filesize
32KB

Download
memory/2232-1-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-2-0x000000001B450000-0x000000001B4D0000-memory.dmp

Filesize
512KB

Download
memory/2232-3-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-4-0x000000001B450000-0x000000001B4D0000-memory.dmp

Filesize
512KB

Download