d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 20:34

Target

d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe
Size

9.9MB
MD5

d2bae1c069cee7ff4be14cf43cd7fcd7
SHA1

4571184e277d6eaeb8acc28858611029cb5622df
SHA256

d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f
SHA512

2434c1562a0c4bb1151dcd382f79b8fe27efee3f8e1aadbbb9a61490e82d0852c1a24c8bab97357f682f9b4d485360f429ef3d8c0d22e142434066d8e5f5624e
SSDEEP

196608:3JXhg9UcN/qpGQ8uR1YtFvOszddI7xCfKvbUe1ZtetPRZn0:3VhgLN/qpGQLRetFvOspkAaotPRN0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	2400	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1292	2400	d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe	28
PID 2400 wrote to memory of 1292	2400	d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe	28
PID 2400 wrote to memory of 1292	2400	d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe	28
PID 2400 wrote to memory of 1292	2400	d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe	28

C:\Users\Admin\AppData\Local\Temp\d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe
"C:\Users\Admin\AppData\Local\Temp\d670404383dfb6505b48f748b7f5ac49cb67c552531558062faceb17126a566f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 480
  2⤵
  - Program crash
  PID:1292

memory/2400-0-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/2400-1-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/2400-2-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/2400-5-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/2400-6-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/2400-8-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download