f96714a445ffb7b71abd125fa5ba9511978c0ffdf14459a78164b45fcf19d46d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 12:34

Target

7a44871e5356b3338c682629a09edf13.exe
Size

9KB
MD5

7a44871e5356b3338c682629a09edf13
SHA1

c0c3cde28d18251217d6e1b498752c936e547c71
SHA256

f96714a445ffb7b71abd125fa5ba9511978c0ffdf14459a78164b45fcf19d46d
SHA512

47c2b59e1ec974870a46b22dcc5da6578290f303669cfecd3c3c3a421def65c3c140a081a93d906717b3547abfbfca2c97d0f3de3d0d53a010eba705cc4715af
SSDEEP

192:2BksuDrN3y+6feMZZ3293VnjdwCzE3O7b7pyvO:FZ8feMiFnhwCIeFyv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	7a44871e5356b3338c682629a09edf13.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2748	1948	7a44871e5356b3338c682629a09edf13.exe	28
PID 1948 wrote to memory of 2748	1948	7a44871e5356b3338c682629a09edf13.exe	28
PID 1948 wrote to memory of 2748	1948	7a44871e5356b3338c682629a09edf13.exe	28

C:\Users\Admin\AppData\Local\Temp\7a44871e5356b3338c682629a09edf13.exe
"C:\Users\Admin\AppData\Local\Temp\7a44871e5356b3338c682629a09edf13.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1948 -s 904
  2⤵
  PID:2748

memory/1948-0-0x0000000000C30000-0x0000000000C38000-memory.dmp

Filesize
32KB

Download
memory/1948-1-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1948-2-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download
memory/1948-3-0x000007FEF50C0000-0x000007FEF5AAC000-memory.dmp

Filesize
9.9MB

Download
memory/1948-4-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download