231b598e542d2d589c779995f28862da469032f8bfec1381de05d10515c8b60e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 05:56

Target

861c024268cc54b4a64e63c1a2ba0965.exe
Size

9KB
MD5

861c024268cc54b4a64e63c1a2ba0965
SHA1

ad855638d80fa66b9393e8f924ae35bb86298eef
SHA256

231b598e542d2d589c779995f28862da469032f8bfec1381de05d10515c8b60e
SHA512

17e6e3be6e2ca4ed39a1e213d953a52adb2399c7356b6b31628bfa43c970df0a16d4ebabe511d4bbb21b8a0740fd30a119bbd59426d2c1c8b3c519365cfcc0d3
SSDEEP

192:7ONBksuHEXVwVa4eMZZ3N93VnjdwCzf3bfG:7IVwc4eMnFnhwCrLf

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	861c024268cc54b4a64e63c1a2ba0965.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2252	2352	861c024268cc54b4a64e63c1a2ba0965.exe	28
PID 2352 wrote to memory of 2252	2352	861c024268cc54b4a64e63c1a2ba0965.exe	28
PID 2352 wrote to memory of 2252	2352	861c024268cc54b4a64e63c1a2ba0965.exe	28

C:\Users\Admin\AppData\Local\Temp\861c024268cc54b4a64e63c1a2ba0965.exe
"C:\Users\Admin\AppData\Local\Temp\861c024268cc54b4a64e63c1a2ba0965.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2352 -s 896
  2⤵
  PID:2252

memory/2352-0-0x0000000000D40000-0x0000000000D48000-memory.dmp

Filesize
32KB

Download
memory/2352-1-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2352-2-0x000000001B4A0000-0x000000001B520000-memory.dmp

Filesize
512KB

Download
memory/2352-3-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2352-4-0x000000001B4A0000-0x000000001B520000-memory.dmp

Filesize
512KB

Download