7a84efcf08949adc80fc115f1da3fe4f153e270eb047ea8e96a584299936324e

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 18:14

Target

51426225675c0ddb35e94704265ae42f.exe
Size

5KB
MD5

51426225675c0ddb35e94704265ae42f
SHA1

c28dffec6f9478034bebdb6a2328c5fdfd370a24
SHA256

7a84efcf08949adc80fc115f1da3fe4f153e270eb047ea8e96a584299936324e
SHA512

a7d62e5e096c69508adc0f201dbc5c4c9d32ebe075851b1fd5c7945143d222b7a7018796f9a0ed355173510eecf624215bf654a64259ab0bedb2c6baf1e9d63a
SSDEEP

48:6ZccNnlZOJ6dbKhIBo7hzNMPB+0b9ZSMLuYbr/it1PlPvP7FYvpfbNtm:O3OJ6db2H7cDbydv6BzNt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2064 1940 WerFault.exe 51426225675c0ddb35e94704265ae42f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

51426225675c0ddb35e94704265ae42f.exe

description pid process

Token: SeDebugPrivilege 1940 51426225675c0ddb35e94704265ae42f.exe

pid	pid_target	process	target process
2064	1940	WerFault.exe	51426225675c0ddb35e94704265ae42f.exe

description	pid	process
Token: SeDebugPrivilege	1940	51426225675c0ddb35e94704265ae42f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

51426225675c0ddb35e94704265ae42f.exe

description	pid	process	target process
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	WerFault.exe
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	WerFault.exe
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	WerFault.exe
PID 1940 wrote to memory of 2064	1940	51426225675c0ddb35e94704265ae42f.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 984
2⤵
- Program crash
PID:2064

memory/1940-1-0x0000000074290000-0x000000007497E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-0-0x00000000009B0000-0x00000000009B8000-memory.dmp

Filesize
32KB

Download
memory/1940-2-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/1940-3-0x0000000074290000-0x000000007497E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-4-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download