00f78150bac1850fe547451286e06f62299a2c1521624f5b6c542bc940f91c25

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:16

Target

2d044cb9612f62dfd61475e6fb0f6939.exe
Size

9KB
MD5

2d044cb9612f62dfd61475e6fb0f6939
SHA1

61933f2514009b46bc4c163072e094c7345dc87b
SHA256

00f78150bac1850fe547451286e06f62299a2c1521624f5b6c542bc940f91c25
SHA512

ce309d5da9a04987c72f6b7cb7a561f34be458334e6706012260321d8adc0ee49216c12f0c7249b860bd341231818538a7dede05b443ccebc3621cc4609da352
SSDEEP

192:pBksu39MuIW1eMZZ3193Vnjdwqzb33sVU:6lD1eMfFnhwqnsV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	2d044cb9612f62dfd61475e6fb0f6939.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2128	2936	2d044cb9612f62dfd61475e6fb0f6939.exe	28
PID 2936 wrote to memory of 2128	2936	2d044cb9612f62dfd61475e6fb0f6939.exe	28
PID 2936 wrote to memory of 2128	2936	2d044cb9612f62dfd61475e6fb0f6939.exe	28

C:\Users\Admin\AppData\Local\Temp\2d044cb9612f62dfd61475e6fb0f6939.exe
"C:\Users\Admin\AppData\Local\Temp\2d044cb9612f62dfd61475e6fb0f6939.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2936 -s 892
  2⤵
  PID:2128

memory/2936-0-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/2936-1-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2936-2-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download
memory/2936-3-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2936-4-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download