c8c0094d90663c6f07fdf5eb0664670e370f50d1df3f262fb023ac42feb03602

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 00:33

Target

64038be2ac898837809a9fd1ce2d8085.exe
Size

9KB
MD5

64038be2ac898837809a9fd1ce2d8085
SHA1

fb1bec03969d4c0f9e9bd74f2f457b48957f9173
SHA256

c8c0094d90663c6f07fdf5eb0664670e370f50d1df3f262fb023ac42feb03602
SHA512

c14bb14fa094b319b9c0993bcd3a595b9f00347ddf3b0a8f72660ebd1b5057933dd2a0f457d8f5e063e1636167e4ce1348046452e70b48476e05e4c4e63a1f47
SSDEEP

192:PBksuzPY82gQv5F4bHtXeMZZ3c93VnjdwCzj3R0d:l82l4ztXeMIFnhwCHO

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	64038be2ac898837809a9fd1ce2d8085.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2648	2284	64038be2ac898837809a9fd1ce2d8085.exe	28
PID 2284 wrote to memory of 2648	2284	64038be2ac898837809a9fd1ce2d8085.exe	28
PID 2284 wrote to memory of 2648	2284	64038be2ac898837809a9fd1ce2d8085.exe	28

C:\Users\Admin\AppData\Local\Temp\64038be2ac898837809a9fd1ce2d8085.exe
"C:\Users\Admin\AppData\Local\Temp\64038be2ac898837809a9fd1ce2d8085.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2284 -s 892
  2⤵
  PID:2648

memory/2284-0-0x00000000011C0000-0x00000000011C8000-memory.dmp

Filesize
32KB

Download
memory/2284-1-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/2284-2-0x000000001B470000-0x000000001B4F0000-memory.dmp

Filesize
512KB

Download
memory/2284-3-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/2284-4-0x000000001B470000-0x000000001B4F0000-memory.dmp

Filesize
512KB

Download