a443e0ff8b56efff342ea1fbaa5ae6269e0c23827baec731617ddff108701e38

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:54

Target

2552dc62719c6e38dd531bd30b035185.exe
Size

9KB
MD5

2552dc62719c6e38dd531bd30b035185
SHA1

0b790ebfac6553d40ecc5dc58bd7e34673fb3267
SHA256

a443e0ff8b56efff342ea1fbaa5ae6269e0c23827baec731617ddff108701e38
SHA512

c36fc5638ad38b30500b2c3d2f8b985842f774c0bb82c769475db1054cd26de33e46f5e0b7bd9ed2976ceca2eadfa44599e6ad54ba1dd6045422e1d8174d7cb8
SSDEEP

192:QBksunPY82gQv5F4BtOeMZZ3z93VnjdwCzJ3mPx:c82l4BtOeMFFnhwC1O

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	2552dc62719c6e38dd531bd30b035185.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2572	2032	2552dc62719c6e38dd531bd30b035185.exe	28
PID 2032 wrote to memory of 2572	2032	2552dc62719c6e38dd531bd30b035185.exe	28
PID 2032 wrote to memory of 2572	2032	2552dc62719c6e38dd531bd30b035185.exe	28

C:\Users\Admin\AppData\Local\Temp\2552dc62719c6e38dd531bd30b035185.exe
"C:\Users\Admin\AppData\Local\Temp\2552dc62719c6e38dd531bd30b035185.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2032 -s 896
  2⤵
  PID:2572

memory/2032-0-0x00000000011B0000-0x00000000011B8000-memory.dmp

Filesize
32KB

Download
memory/2032-1-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-2-0x000000001A9C0000-0x000000001AA40000-memory.dmp

Filesize
512KB

Download
memory/2032-3-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-4-0x000000001A9C0000-0x000000001AA40000-memory.dmp

Filesize
512KB

Download