0635241c3169aae7a32169a87fd0b73b7b5dc9dee33ded32d400825d5265a7c2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 14:06

Target

74e2ced20f713e15b27b04ff0ff781cc.exe
Size

9KB
MD5

74e2ced20f713e15b27b04ff0ff781cc
SHA1

4805f8ca66e78c66f1b8c6493e661d8af8015ada
SHA256

0635241c3169aae7a32169a87fd0b73b7b5dc9dee33ded32d400825d5265a7c2
SHA512

f8e081427ac34997711b644205f234aa2949be55772afe896dc9749a996b76f5f672f8844d86c7a04f429548402f83124789ef1687e2464109bbdd9063e2c01a
SSDEEP

192:JBksurEXVwVp/eMZZ3tu93VnjdwCzk3oXQDo:DVwT/eMRuFnhwCY0QD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	74e2ced20f713e15b27b04ff0ff781cc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2772	2476	74e2ced20f713e15b27b04ff0ff781cc.exe	28
PID 2476 wrote to memory of 2772	2476	74e2ced20f713e15b27b04ff0ff781cc.exe	28
PID 2476 wrote to memory of 2772	2476	74e2ced20f713e15b27b04ff0ff781cc.exe	28

C:\Users\Admin\AppData\Local\Temp\74e2ced20f713e15b27b04ff0ff781cc.exe
"C:\Users\Admin\AppData\Local\Temp\74e2ced20f713e15b27b04ff0ff781cc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2476 -s 896
  2⤵
  PID:2772

memory/2476-0-0x0000000001380000-0x0000000001388000-memory.dmp

Filesize
32KB

Download
memory/2476-1-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2476-2-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download
memory/2476-3-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2476-4-0x000000001B440000-0x000000001B4C0000-memory.dmp

Filesize
512KB

Download