84d12463d75e81a05caec7a2e5392f5f7018674bd74375633aad74de06649ed7

Analysis

max time kernel
53s
max time network
68s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 14:16

Target

4e853efbbda638608267dbaa886fd5bc.exe
Size

531KB
MD5

4e853efbbda638608267dbaa886fd5bc
SHA1

a8ad8100c47cf05b503ed24ae9b8d4b3a3df7dad
SHA256

84d12463d75e81a05caec7a2e5392f5f7018674bd74375633aad74de06649ed7
SHA512

c320746f81ad8c350903af327ec47f08abfa4ac8bde9af79c0bdf4f872d25c348704f483b6afbc3241862ff2972d0ca88b13d7b0ae2319c800999f15abc3207c
SSDEEP

6144:JMLwAryAY+3uzV4IM1xES2jsCr3kYhsrL8LMuN4RdvxRB3E:OwAWh+35HxE9jrr3kSLDenvf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2568	2956	WerFault.exe	18

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	4e853efbbda638608267dbaa886fd5bc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2568	2956	4e853efbbda638608267dbaa886fd5bc.exe	29
PID 2956 wrote to memory of 2568	2956	4e853efbbda638608267dbaa886fd5bc.exe	29
PID 2956 wrote to memory of 2568	2956	4e853efbbda638608267dbaa886fd5bc.exe	29
PID 2956 wrote to memory of 2568	2956	4e853efbbda638608267dbaa886fd5bc.exe	29

C:\Users\Admin\AppData\Local\Temp\4e853efbbda638608267dbaa886fd5bc.exe
"C:\Users\Admin\AppData\Local\Temp\4e853efbbda638608267dbaa886fd5bc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 1084
  2⤵
  - Program crash
  PID:2568

memory/2956-0-0x0000000000F70000-0x0000000000FFC000-memory.dmp

Filesize
560KB

Download
memory/2956-1-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-2-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/2956-3-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-4-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download