7a84efcf08949adc80fc115f1da3fe4f153e270eb047ea8e96a584299936324e

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 18:14

Target

51426225675c0ddb35e94704265ae42f.exe
Size

5KB
MD5

51426225675c0ddb35e94704265ae42f
SHA1

c28dffec6f9478034bebdb6a2328c5fdfd370a24
SHA256

7a84efcf08949adc80fc115f1da3fe4f153e270eb047ea8e96a584299936324e
SHA512

a7d62e5e096c69508adc0f201dbc5c4c9d32ebe075851b1fd5c7945143d222b7a7018796f9a0ed355173510eecf624215bf654a64259ab0bedb2c6baf1e9d63a
SSDEEP

48:6ZccNnlZOJ6dbKhIBo7hzNMPB+0b9ZSMLuYbr/it1PlPvP7FYvpfbNtm:O3OJ6db2H7cDbydv6BzNt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1940	WerFault.exe	16

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	51426225675c0ddb35e94704265ae42f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	28
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	28
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	28
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	28

C:\Users\Admin\AppData\Local\Temp\51426225675c0ddb35e94704265ae42f.exe
"C:\Users\Admin\AppData\Local\Temp\51426225675c0ddb35e94704265ae42f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 984
  2⤵
  - Program crash
  PID:2064

memory/1940-1-0x0000000074290000-0x000000007497E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-0-0x00000000009B0000-0x00000000009B8000-memory.dmp

Filesize
32KB

Download
memory/1940-2-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/1940-3-0x0000000074290000-0x000000007497E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-4-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download