74df9233610c42c24695bafcaf9323ce7b0730b5687688d19ae03904951b4273

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 11:57

Target

462b44f18aac5916763b2d9e188ddf60.exe
Size

9KB
MD5

462b44f18aac5916763b2d9e188ddf60
SHA1

c20f372769706ce9beafa5b53f079dba9157bb84
SHA256

74df9233610c42c24695bafcaf9323ce7b0730b5687688d19ae03904951b4273
SHA512

dde9565a61201b111b34021f0df09d1ce0937023518777eea64b04f17bf2700aa39ca0f3f1e6020ee71743cc5a8d7bb46ebe7e0513592b8b2324d33a12dc737e
SSDEEP

192:aBksuHEXVwV4GeMZZ3393VnjdwCzq3Gcxx5g:CVw2GeM5FnhwC+Wcxx5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	462b44f18aac5916763b2d9e188ddf60.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2408	1684	462b44f18aac5916763b2d9e188ddf60.exe	28
PID 1684 wrote to memory of 2408	1684	462b44f18aac5916763b2d9e188ddf60.exe	28
PID 1684 wrote to memory of 2408	1684	462b44f18aac5916763b2d9e188ddf60.exe	28

C:\Users\Admin\AppData\Local\Temp\462b44f18aac5916763b2d9e188ddf60.exe
"C:\Users\Admin\AppData\Local\Temp\462b44f18aac5916763b2d9e188ddf60.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1684 -s 892
  2⤵
  PID:2408

memory/1684-0-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/1684-1-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/1684-2-0x000000001B2D0000-0x000000001B350000-memory.dmp

Filesize
512KB

Download
memory/1684-3-0x000007FEF59D0000-0x000007FEF63BC000-memory.dmp

Filesize
9.9MB

Download
memory/1684-4-0x000000001B2D0000-0x000000001B350000-memory.dmp

Filesize
512KB

Download