e39b70eccdfa998c27b6522ccb42cc9869f60c131c99c4ce48e411c264bf8706

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 09:15

Target

744e81a561855c841c1d1b96e509fe01.exe
Size

8KB
MD5

744e81a561855c841c1d1b96e509fe01
SHA1

c117442f3ba16c421139df4aa8779c65fa760a32
SHA256

e39b70eccdfa998c27b6522ccb42cc9869f60c131c99c4ce48e411c264bf8706
SHA512

31a2e5ebf2bd9201e71986e7c31556b5251f98997dd117b7e119f1322a123e2211fba93c62984ecc7d45aea51dfe3d3f553b063dc64e94492b0d6a2a7d91f3d3
SSDEEP

96:QjTVzdEZt89ZHzBxilif8KhCF7TCFRCFRCFJCFHCFzCFsCF/yGfoVDUk4RzNt:QU6FBH+XoVDUDz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	2540	WerFault.exe	22

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	744e81a561855c841c1d1b96e509fe01.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2700	2540	744e81a561855c841c1d1b96e509fe01.exe	28
PID 2540 wrote to memory of 2700	2540	744e81a561855c841c1d1b96e509fe01.exe	28
PID 2540 wrote to memory of 2700	2540	744e81a561855c841c1d1b96e509fe01.exe	28
PID 2540 wrote to memory of 2700	2540	744e81a561855c841c1d1b96e509fe01.exe	28

C:\Users\Admin\AppData\Local\Temp\744e81a561855c841c1d1b96e509fe01.exe
"C:\Users\Admin\AppData\Local\Temp\744e81a561855c841c1d1b96e509fe01.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1076
  2⤵
  - Program crash
  PID:2700

memory/2540-0-0x00000000012D0000-0x00000000012D8000-memory.dmp

Filesize
32KB

Download
memory/2540-1-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2540-2-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download
memory/2540-3-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2540-4-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download