81b64178b6c3dddf255911afa43b4d6e54274835c8ec8ca6505622dd6ec1cf7d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 22:48

Target

54cb2dce2550f930e72ac6a26fbf93ef.exe
Size

9KB
MD5

54cb2dce2550f930e72ac6a26fbf93ef
SHA1

99683c78503e940699931de41a8e522da7a23ed9
SHA256

81b64178b6c3dddf255911afa43b4d6e54274835c8ec8ca6505622dd6ec1cf7d
SHA512

aa85beece5e6376da321ed2cb64450e1acdce7a20482a374bf0ec74b4707b9c0d1aa8fd5021febede95271252e1e3cf2adaad36d28c4623fd2904f7d8d0bba2d
SSDEEP

192:bBksuDEXVwV1qeMZZ3T93VnjdwCz63MmbuCr+:lVwPqeMdFnhwCuV5

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	54cb2dce2550f930e72ac6a26fbf93ef.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2796	2056	54cb2dce2550f930e72ac6a26fbf93ef.exe	30
PID 2056 wrote to memory of 2796	2056	54cb2dce2550f930e72ac6a26fbf93ef.exe	30
PID 2056 wrote to memory of 2796	2056	54cb2dce2550f930e72ac6a26fbf93ef.exe	30

C:\Users\Admin\AppData\Local\Temp\54cb2dce2550f930e72ac6a26fbf93ef.exe
"C:\Users\Admin\AppData\Local\Temp\54cb2dce2550f930e72ac6a26fbf93ef.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2056 -s 900
  2⤵
  PID:2796

memory/2056-0-0x00000000000B0000-0x00000000000B8000-memory.dmp

Filesize
32KB

Download
memory/2056-1-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/2056-2-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download
memory/2056-3-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/2056-4-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download