2c78566c0654c2de2fc4fb9b2206865baac6cc5eb5d6cbdc5b800609861b7bc3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 13:43

Target

3d0187ae0e2cf217372462f4bf49ded2.exe
Size

9KB
MD5

3d0187ae0e2cf217372462f4bf49ded2
SHA1

9d0a0d7d8a07aec2be16a919e0afc2c48160d126
SHA256

2c78566c0654c2de2fc4fb9b2206865baac6cc5eb5d6cbdc5b800609861b7bc3
SHA512

ddb9f850e941cac3218d3b64b24442dcabfeb7104d1154311c035bdde6ac95e5cfae209b76a4946139a5d9c22ff0a21ad689665b8f65a57ffe8d235496f1cdaf
SSDEEP

192:VBksun9MuI8beMZZ3P93Vnjdwqzq3wmq:+llbeMJFnhwqWgm

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	3d0187ae0e2cf217372462f4bf49ded2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2364	1960	3d0187ae0e2cf217372462f4bf49ded2.exe	28
PID 1960 wrote to memory of 2364	1960	3d0187ae0e2cf217372462f4bf49ded2.exe	28
PID 1960 wrote to memory of 2364	1960	3d0187ae0e2cf217372462f4bf49ded2.exe	28

C:\Users\Admin\AppData\Local\Temp\3d0187ae0e2cf217372462f4bf49ded2.exe
"C:\Users\Admin\AppData\Local\Temp\3d0187ae0e2cf217372462f4bf49ded2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1960 -s 892
  2⤵
  PID:2364

memory/1960-0-0x0000000000B50000-0x0000000000B58000-memory.dmp

Filesize
32KB

Download
memory/1960-1-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/1960-2-0x000000001B150000-0x000000001B1D0000-memory.dmp

Filesize
512KB

Download
memory/1960-3-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/1960-4-0x000000001B150000-0x000000001B1D0000-memory.dmp

Filesize
512KB

Download