136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 17:02

Target

136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d.exe
Size

42KB
MD5

55c48b5f30ac691540e7093151f89a69
SHA1

680797c51d7035af1d5719b4b91e9903861ee6d3
SHA256

136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d
SHA512

c22a531b2fe015dccb2be900436d008bea90ad9c12fec9b4980f2df9872a15ae1649469d7953eddd8981f8be485b4e2e6f3db73a37cb10feb85df274786b5b25
SSDEEP

768:jlM4lfMVE8bXc4DnC4rMeRVLR/swsPnG4W27TpzCZbrDKFKv+:jlM4lfMVDbs0MYsm27TUZbrj+

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2736	2496	136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d.exe	28
PID 2496 wrote to memory of 2736	2496	136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d.exe	28
PID 2496 wrote to memory of 2736	2496	136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d.exe	28

C:\Users\Admin\AppData\Local\Temp\136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d.exe
"C:\Users\Admin\AppData\Local\Temp\136ced869a73c98ae6c181e429709294168bfaa573a53d4c452edfe90c7b1d7d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2496 -s 932
  2⤵
  PID:2736

memory/2496-0-0x000000013F640000-0x000000013F64E000-memory.dmp

Filesize
56KB

Download
memory/2496-1-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-2-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download
memory/2496-3-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-4-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download