a14b57cb9b98e9b780d1f2fe7d81fd0e27376b9e39199e31dbd3d5c636decab9

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 00:30

Target

8dc26d664263ee12cec2c44ccf896aa8.exe
Size

9KB
MD5

8dc26d664263ee12cec2c44ccf896aa8
SHA1

c9da962707c31c5f5daf144410f655bfd8780990
SHA256

a14b57cb9b98e9b780d1f2fe7d81fd0e27376b9e39199e31dbd3d5c636decab9
SHA512

a28a2d80f17463632aca69261fee8925bf523b8dae9affbf7815af2779174dd65420e79836e6286084d0c627342cbcdaa034a48052a0ca8a202251f8fa3db2c9
SSDEEP

192:CBksuXm6N7oy1tmeMZZ3A93Vnjdwqzj3F9Zic:I4x3meMcFnhwqXfZi

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	8dc26d664263ee12cec2c44ccf896aa8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2944	3000	8dc26d664263ee12cec2c44ccf896aa8.exe	30
PID 3000 wrote to memory of 2944	3000	8dc26d664263ee12cec2c44ccf896aa8.exe	30
PID 3000 wrote to memory of 2944	3000	8dc26d664263ee12cec2c44ccf896aa8.exe	30

C:\Users\Admin\AppData\Local\Temp\8dc26d664263ee12cec2c44ccf896aa8.exe
"C:\Users\Admin\AppData\Local\Temp\8dc26d664263ee12cec2c44ccf896aa8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3000 -s 896
  2⤵
  PID:2944

memory/3000-0-0x0000000000030000-0x0000000000038000-memory.dmp

Filesize
32KB

Download
memory/3000-1-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/3000-2-0x000000001B280000-0x000000001B300000-memory.dmp

Filesize
512KB

Download
memory/3000-3-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/3000-4-0x000000001B280000-0x000000001B300000-memory.dmp

Filesize
512KB

Download