82c58da48e1c681cab6665b54022303a825c15fea09331d9803d4ad7c2bd8eaf

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 02:53

Target

47d4dc08e281dcc3ca590049095f1586.exe
Size

9KB
MD5

47d4dc08e281dcc3ca590049095f1586
SHA1

4af803450cfd2d86d690a36a2526cd4c9d7babe8
SHA256

82c58da48e1c681cab6665b54022303a825c15fea09331d9803d4ad7c2bd8eaf
SHA512

843cd3eef397e6da2a869bfd4d1361eced744805810fd6eaae6e0990c2f907fb62f958eed96cd252aa957b03e0522565674d6e2d6548ddb54ab29a662244e20a
SSDEEP

192:sBksuXm6N7oy1KYeMZZ3W93VnjdwqzN3km64bPoF:u4xQYeMaFnhwqB0mXbPo

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	47d4dc08e281dcc3ca590049095f1586.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2708	1860	47d4dc08e281dcc3ca590049095f1586.exe	30
PID 1860 wrote to memory of 2708	1860	47d4dc08e281dcc3ca590049095f1586.exe	30
PID 1860 wrote to memory of 2708	1860	47d4dc08e281dcc3ca590049095f1586.exe	30

C:\Users\Admin\AppData\Local\Temp\47d4dc08e281dcc3ca590049095f1586.exe
"C:\Users\Admin\AppData\Local\Temp\47d4dc08e281dcc3ca590049095f1586.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1860 -s 896
  2⤵
  PID:2708

memory/1860-0-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

Filesize
32KB

Download
memory/1860-1-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

Filesize
9.9MB

Download
memory/1860-2-0x0000000000B70000-0x0000000000BF0000-memory.dmp

Filesize
512KB

Download
memory/1860-3-0x000007FEF5560000-0x000007FEF5F4C000-memory.dmp

Filesize
9.9MB

Download
memory/1860-4-0x0000000000B70000-0x0000000000BF0000-memory.dmp

Filesize
512KB

Download