96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 06:58

Target

96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe
Size

5.0MB
MD5

2c7b3b29eb3d05bb247a93625dbb33a8
SHA1

34b6073871ef62749b3f3ee5966dc011d6a13a19
SHA256

96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4
SHA512

43eaec75813fd1a3e627b172216fed37835fca7c1bb60a6d56b0b5565f45bed2569fe21a736df301f3cca0f5af46f23e65f657657d255a83c637fb0b717a46fb
SSDEEP

49152:0t0jTN4mEj+IEJLO5SFEWX93pVqr7NpDexp17ab1gmOb7dQ8QGsjTFmh8PCIYr+Z:rH5pkVJRoVRy5VE+WG/rNvGVmGO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	2996	WerFault.exe	16

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2996	96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe
2996	96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3056	2996	96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe	18
PID 2996 wrote to memory of 3056	2996	96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe	18
PID 2996 wrote to memory of 3056	2996	96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe	18
PID 2996 wrote to memory of 3056	2996	96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe	18

C:\Users\Admin\AppData\Local\Temp\96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe
"C:\Users\Admin\AppData\Local\Temp\96f73009fd6670008098f08855744492ac4519c0b170100229046cab3b7e70c4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 348
  2⤵
  - Program crash
  PID:3056

memory/2996-1-0x00000000777F0000-0x0000000077900000-memory.dmp

Filesize
1.1MB

Download
memory/2996-0-0x0000000000400000-0x000000000090C000-memory.dmp

Filesize
5.0MB

Download