95552b0dbf15f1b7fb3b9959e2f92cd40959f375cc88faa6878643784616608a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:38

Target

2a4e72c70a031b8442f9143f5560d6ec.exe
Size

9KB
MD5

2a4e72c70a031b8442f9143f5560d6ec
SHA1

e13ddd90d9a59e4044333484f2a8e94fb7afffb9
SHA256

95552b0dbf15f1b7fb3b9959e2f92cd40959f375cc88faa6878643784616608a
SHA512

9ec73bf894aa14513c522e52341d9f82ad2221cf7c1d5f51b0a7665e516095f26ee22320831a062c53d6c6de4f399430d79056ec87ae62c1b2c93fc0d6685aca
SSDEEP

192:hBksuzPY82gQv5F4ut/eMZZ3Y93VnjdwCzp34xJK8d:v82l4ut/eM0FnhwCVoxJK8

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	2a4e72c70a031b8442f9143f5560d6ec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2004	2928	2a4e72c70a031b8442f9143f5560d6ec.exe	28
PID 2928 wrote to memory of 2004	2928	2a4e72c70a031b8442f9143f5560d6ec.exe	28
PID 2928 wrote to memory of 2004	2928	2a4e72c70a031b8442f9143f5560d6ec.exe	28

C:\Users\Admin\AppData\Local\Temp\2a4e72c70a031b8442f9143f5560d6ec.exe
"C:\Users\Admin\AppData\Local\Temp\2a4e72c70a031b8442f9143f5560d6ec.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2928 -s 892
  2⤵
  PID:2004

memory/2928-0-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/2928-1-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2928-2-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download
memory/2928-3-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2928-4-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download