6842221ccf21f1d62048d7d7b8499e07b286ff0f3a17d4885ca71ad0d0017760

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 08:10

Target

865fb7c2641dfeaa5f81d8a255a972a0.exe
Size

9KB
MD5

865fb7c2641dfeaa5f81d8a255a972a0
SHA1

0c183824e7a6061c7bbe77b787897fbfcfaa5401
SHA256

6842221ccf21f1d62048d7d7b8499e07b286ff0f3a17d4885ca71ad0d0017760
SHA512

413ed860a3b42aebb81dca40051ccfac6aa33a4a051049b43b4d6922f735146c222ca5976781d8d2ee4bd9b9b60600e37e8591e321fd74e0bc1d37fdad9aedd3
SSDEEP

192:RBksuL9MuIvveMZZ33D93Vnjdwqzf37RnuY9:+lqveMDpFnhwqbtnuY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	865fb7c2641dfeaa5f81d8a255a972a0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2816	2184	865fb7c2641dfeaa5f81d8a255a972a0.exe	28
PID 2184 wrote to memory of 2816	2184	865fb7c2641dfeaa5f81d8a255a972a0.exe	28
PID 2184 wrote to memory of 2816	2184	865fb7c2641dfeaa5f81d8a255a972a0.exe	28

C:\Users\Admin\AppData\Local\Temp\865fb7c2641dfeaa5f81d8a255a972a0.exe
"C:\Users\Admin\AppData\Local\Temp\865fb7c2641dfeaa5f81d8a255a972a0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2184 -s 892
  2⤵
  PID:2816

memory/2184-0-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Filesize
32KB

Download
memory/2184-1-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2184-2-0x000000001B340000-0x000000001B3C0000-memory.dmp

Filesize
512KB

Download
memory/2184-3-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2184-4-0x000000001B340000-0x000000001B3C0000-memory.dmp

Filesize
512KB

Download