a6da0ce92cef0d95569373a6e1c55aebe6ee84097ee7fe7685dade79c47c85fd

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:01

Target

74ebed1df26d216d74fcfe6c52f9eb2c.exe
Size

9KB
MD5

74ebed1df26d216d74fcfe6c52f9eb2c
SHA1

e616d9608e25a99e50eee6c01426d968cecad5f8
SHA256

a6da0ce92cef0d95569373a6e1c55aebe6ee84097ee7fe7685dade79c47c85fd
SHA512

f63e30a945505f3fa8422fcef3c22563ea5554265dfb132939e9a6840afc1d6385b29c85d507e5797e0eb048538bad781ab8b1a3f836afc40e91f75555247a8b
SSDEEP

192:WpBksuXm6N7oy1ixeMZZ3F93Vnjdwqzx3wrn:m4xcxeMfFnhwqtgr

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	74ebed1df26d216d74fcfe6c52f9eb2c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2648	2284	74ebed1df26d216d74fcfe6c52f9eb2c.exe	28
PID 2284 wrote to memory of 2648	2284	74ebed1df26d216d74fcfe6c52f9eb2c.exe	28
PID 2284 wrote to memory of 2648	2284	74ebed1df26d216d74fcfe6c52f9eb2c.exe	28

C:\Users\Admin\AppData\Local\Temp\74ebed1df26d216d74fcfe6c52f9eb2c.exe
"C:\Users\Admin\AppData\Local\Temp\74ebed1df26d216d74fcfe6c52f9eb2c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2284 -s 892
  2⤵
  PID:2648

memory/2284-0-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/2284-1-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/2284-2-0x000000001A780000-0x000000001A800000-memory.dmp

Filesize
512KB

Download
memory/2284-3-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/2284-4-0x000000001A780000-0x000000001A800000-memory.dmp

Filesize
512KB

Download