2936dd2916006f8c98c2c816e526a2c06dbe31d763d8465986cb6c7f2112c3d7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 12:31

Target

463c0e6469310f5b7845e4e72b36d39d.exe
Size

9KB
MD5

463c0e6469310f5b7845e4e72b36d39d
SHA1

8cf495ec193a48a651b117f1d3f380d7b0808680
SHA256

2936dd2916006f8c98c2c816e526a2c06dbe31d763d8465986cb6c7f2112c3d7
SHA512

497bffdb45763fdd4c4554e0084be3182d7437954c162057b48ff37b2629b9d9ac11dcef2d029ceefa5db3ed046189deddf4e8969fd69301e4620cf979f02cb5
SSDEEP

192:UBksuLPY82gQv5F4JtOeMZZ3T93VnjdwCz03/cSzb:c82l4JtOeM9FnhwCQvcSz

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	463c0e6469310f5b7845e4e72b36d39d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3048	1372	463c0e6469310f5b7845e4e72b36d39d.exe	28
PID 1372 wrote to memory of 3048	1372	463c0e6469310f5b7845e4e72b36d39d.exe	28
PID 1372 wrote to memory of 3048	1372	463c0e6469310f5b7845e4e72b36d39d.exe	28

C:\Users\Admin\AppData\Local\Temp\463c0e6469310f5b7845e4e72b36d39d.exe
"C:\Users\Admin\AppData\Local\Temp\463c0e6469310f5b7845e4e72b36d39d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1372 -s 892
  2⤵
  PID:3048

memory/1372-0-0x00000000012C0000-0x00000000012C8000-memory.dmp

Filesize
32KB

Download
memory/1372-1-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/1372-2-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/1372-3-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/1372-4-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download