c6fae7c82773863377025bf663578583bd0f4105b9c1856fdf685f0efa787ffe

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 23:29

Target

8da4998e707f3e66308efade04df8fcb.exe
Size

9KB
MD5

8da4998e707f3e66308efade04df8fcb
SHA1

c2be8842695c1c507c45e46bce7c7eea85c19245
SHA256

c6fae7c82773863377025bf663578583bd0f4105b9c1856fdf685f0efa787ffe
SHA512

3a292f462e31b583b46e5faa1ba9d60919cb556f2c0d60cc1b1478388deae20d57154ce4ffba9f5034037a44d7604706185b35374be0907bbe729de7a68431eb
SSDEEP

192:pBksuvPY82gQv5F44tIeMZZ3993VnjdwCzU3CAiyC:z82l44tIeMfFnhwCQsy

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	8da4998e707f3e66308efade04df8fcb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2728	2444	8da4998e707f3e66308efade04df8fcb.exe	28
PID 2444 wrote to memory of 2728	2444	8da4998e707f3e66308efade04df8fcb.exe	28
PID 2444 wrote to memory of 2728	2444	8da4998e707f3e66308efade04df8fcb.exe	28

C:\Users\Admin\AppData\Local\Temp\8da4998e707f3e66308efade04df8fcb.exe
"C:\Users\Admin\AppData\Local\Temp\8da4998e707f3e66308efade04df8fcb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2444 -s 896
  2⤵
  PID:2728

memory/2444-0-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

Filesize
32KB

Download
memory/2444-1-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2444-2-0x000000001AC50000-0x000000001ACD0000-memory.dmp

Filesize
512KB

Download
memory/2444-3-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2444-4-0x000000001AC50000-0x000000001ACD0000-memory.dmp

Filesize
512KB

Download