41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 20:22

Target

D3E0800E550889AD45270980CA5D31D2.exe
Size

65KB
MD5

d3e0800e550889ad45270980ca5d31d2
SHA1

3cc43700ce7b812c3c90d74b1fb7757cc14dd026
SHA256

41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229
SHA512

bf4b5ae13f5ae0371d87c33245e54271f45b93a213adc9cc7328d10df1f249efb165718d4949b1320e9223a3d8d313460d9386599ede0366842b527c03a3be1c
SSDEEP

768:Y/qvB/iUdgf7x44gpjoc3+0gJou/WDkdR0ybsazEPMV8PMeNkyAqFnviseo:hJqpXSotK5aeN5Jxviseo

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2712 1988 WerFault.exe D3E0800E550889AD45270980CA5D31D2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

D3E0800E550889AD45270980CA5D31D2.exe

description pid process

Token: SeDebugPrivilege 1988 D3E0800E550889AD45270980CA5D31D2.exe

pid	pid_target	process	target process
2712	1988	WerFault.exe	D3E0800E550889AD45270980CA5D31D2.exe

description	pid	process
Token: SeDebugPrivilege	1988	D3E0800E550889AD45270980CA5D31D2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

D3E0800E550889AD45270980CA5D31D2.exe

description	pid	process	target process
PID 1988 wrote to memory of 2712	1988	D3E0800E550889AD45270980CA5D31D2.exe	WerFault.exe
PID 1988 wrote to memory of 2712	1988	D3E0800E550889AD45270980CA5D31D2.exe	WerFault.exe
PID 1988 wrote to memory of 2712	1988	D3E0800E550889AD45270980CA5D31D2.exe	WerFault.exe
PID 1988 wrote to memory of 2712	1988	D3E0800E550889AD45270980CA5D31D2.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1076
2⤵
- Program crash
PID:2712

memory/1988-0-0x0000000000130000-0x0000000000146000-memory.dmp

Filesize
88KB

Download
memory/1988-1-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1988-2-0x0000000000630000-0x0000000000670000-memory.dmp

Filesize
256KB

Download
memory/1988-3-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1988-4-0x0000000000630000-0x0000000000670000-memory.dmp

Filesize
256KB

Download