442244b097b1817a0d7da44115977e24ec99934b13e378e1626f66cbcaa212fd

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:14

Target

2b62f5c03a151d6adf1e1b69be89dca3.exe
Size

9KB
MD5

2b62f5c03a151d6adf1e1b69be89dca3
SHA1

449212a029347abde883d5ce97d13e55a30fb4a7
SHA256

442244b097b1817a0d7da44115977e24ec99934b13e378e1626f66cbcaa212fd
SHA512

0c61c5934a0f0edd9e3d0d9d9607e99029709709e22ba6339c4c8ec5fdb62b754be3edc5e9a26f535d2bf736335fa4f68dcef71e2bceb3b8a5bb3d63b0bc49ea
SSDEEP

192:zBksuv9MuIr3eMZZ3z93Vnjdwqz33ppXl:Ylm3eMVFnhwqzL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	2b62f5c03a151d6adf1e1b69be89dca3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3044	2868	2b62f5c03a151d6adf1e1b69be89dca3.exe	30
PID 2868 wrote to memory of 3044	2868	2b62f5c03a151d6adf1e1b69be89dca3.exe	30
PID 2868 wrote to memory of 3044	2868	2b62f5c03a151d6adf1e1b69be89dca3.exe	30

C:\Users\Admin\AppData\Local\Temp\2b62f5c03a151d6adf1e1b69be89dca3.exe
"C:\Users\Admin\AppData\Local\Temp\2b62f5c03a151d6adf1e1b69be89dca3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2868 -s 900
  2⤵
  PID:3044

memory/2868-0-0x00000000010D0000-0x00000000010D8000-memory.dmp

Filesize
32KB

Download
memory/2868-1-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2868-2-0x000000001B4E0000-0x000000001B560000-memory.dmp

Filesize
512KB

Download
memory/2868-3-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2868-4-0x000000001B4E0000-0x000000001B560000-memory.dmp

Filesize
512KB

Download