f7b34c4d0891871f7c5599c8c0691f7f8a02f80df99e6ba854eac88361bcfb22

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:46

Target

234b27e2e44240ccae5cc4189a9a0209.exe
Size

9KB
MD5

234b27e2e44240ccae5cc4189a9a0209
SHA1

65d114cec9a74f9f4f7928501719ee80b7b9a72c
SHA256

f7b34c4d0891871f7c5599c8c0691f7f8a02f80df99e6ba854eac88361bcfb22
SHA512

486b24be42e1333e438ea05fda7702b7cfdfdfe995560bedd5b1e78e5f83778831f853fcdde45b6e8e3fc27017b951551f6831a426ef18167efaa065c88b154c
SSDEEP

192:nBksuDzHNQqyeMZZ3W93Vnjdwqzt3sGXG4s:oH9yeMiFnhwqRLG4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	234b27e2e44240ccae5cc4189a9a0209.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2700	1396	234b27e2e44240ccae5cc4189a9a0209.exe	28
PID 1396 wrote to memory of 2700	1396	234b27e2e44240ccae5cc4189a9a0209.exe	28
PID 1396 wrote to memory of 2700	1396	234b27e2e44240ccae5cc4189a9a0209.exe	28

C:\Users\Admin\AppData\Local\Temp\234b27e2e44240ccae5cc4189a9a0209.exe
"C:\Users\Admin\AppData\Local\Temp\234b27e2e44240ccae5cc4189a9a0209.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1396 -s 912
  2⤵
  PID:2700

memory/1396-0-0x00000000010C0000-0x00000000010C8000-memory.dmp

Filesize
32KB

Download
memory/1396-1-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/1396-2-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download
memory/1396-3-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/1396-4-0x000000001B220000-0x000000001B2A0000-memory.dmp

Filesize
512KB

Download