49721628109baa250ab8c0c59f48b6a68fb12042f302c82e0bab9f642a462043

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 03:35

Target

4d3c06592e1f5cb9c183e1839369a62f.exe
Size

9KB
MD5

4d3c06592e1f5cb9c183e1839369a62f
SHA1

bbb9e2143a8023b84e47a689bf64977d057d3751
SHA256

49721628109baa250ab8c0c59f48b6a68fb12042f302c82e0bab9f642a462043
SHA512

f7dfc24a542ceca871b041a88801c71509d4ceeddd18fa12dc6c6052b4a8de36ebea27b8b27ac8dd55e5aaaee77cebbe087633242057c2dc10324ea1762d0de8
SSDEEP

192:fBksuPrN3y+hbeMZZ3tk93VnjdwCzzq3Ge/:wZPbeMR0FnhwCS2e

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	4d3c06592e1f5cb9c183e1839369a62f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2740	1732	4d3c06592e1f5cb9c183e1839369a62f.exe	28
PID 1732 wrote to memory of 2740	1732	4d3c06592e1f5cb9c183e1839369a62f.exe	28
PID 1732 wrote to memory of 2740	1732	4d3c06592e1f5cb9c183e1839369a62f.exe	28

C:\Users\Admin\AppData\Local\Temp\4d3c06592e1f5cb9c183e1839369a62f.exe
"C:\Users\Admin\AppData\Local\Temp\4d3c06592e1f5cb9c183e1839369a62f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 904
  2⤵
  PID:2740

memory/1732-0-0x0000000000200000-0x0000000000208000-memory.dmp

Filesize
32KB

Download
memory/1732-1-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-2-0x0000000000590000-0x0000000000610000-memory.dmp

Filesize
512KB

Download
memory/1732-3-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/1732-4-0x0000000000590000-0x0000000000610000-memory.dmp

Filesize
512KB

Download