b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666

Analysis

max time kernel
143s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 00:33

Target

b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe
Size

11.9MB
MD5

6d91a7b999d8ca07a5234b06eaed9558
SHA1

c22e004f4e5e5b9b2d82daa5ee0a273fc9e4348a
SHA256

b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666
SHA512

f73fb20493a96ee0f1f247f9ffc48e7521e3d8d31bc436c657e67496135013b828983ffdb0e2c7af242847111e229492b8e4691f06bf03abe0d5702b583144d0
SSDEEP

196608:3JXhg9UcN/qpGQ8uR1YtZvOszddI7xCfKvbUe1ZtetPRZnIbHCUiGMR:3VhgLN/qpGQLRetZvOspkAaotPRNIbB0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	2448	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2708	2448	b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe	28
PID 2448 wrote to memory of 2708	2448	b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe	28
PID 2448 wrote to memory of 2708	2448	b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe	28
PID 2448 wrote to memory of 2708	2448	b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe	28

C:\Users\Admin\AppData\Local\Temp\b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe
"C:\Users\Admin\AppData\Local\Temp\b79aff9c748821895f6737d34b43819e378b326a10f51c07a2fd9dd15ab99666.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 480
  2⤵
  - Program crash
  PID:2708

memory/2448-0-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/2448-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/2448-2-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/2448-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/2448-6-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/2448-8-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download