5431329e4582d5020c47d181c2108b726e579a40519e356b3b5ec1bf4e2d03ad

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 06:29

Target

967e322618cd34720d89e88fa044deff.exe
Size

88KB
MD5

967e322618cd34720d89e88fa044deff
SHA1

006eb16f94a9a0a81b4225693ebf83b71ed8f45b
SHA256

5431329e4582d5020c47d181c2108b726e579a40519e356b3b5ec1bf4e2d03ad
SHA512

0af3610550424e6322c9a65015df2399f2d0f78abcaa8c2c88d360bbc92c70577a024f07e4d0e75a1ed56d6d07d1669ca9ee4ab4874130f891d5a37b9e0fe56d
SSDEEP

1536:gex/+2H3td9lWixUP4VQpiphWQYjpHScmASqVF+nk+ml+9w8://+279siU4Cg8mkVF+k/8

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	967e322618cd34720d89e88fa044deff.exe
2060	967e322618cd34720d89e88fa044deff.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	967e322618cd34720d89e88fa044deff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1832	2060	967e322618cd34720d89e88fa044deff.exe	28
PID 2060 wrote to memory of 1832	2060	967e322618cd34720d89e88fa044deff.exe	28
PID 2060 wrote to memory of 1832	2060	967e322618cd34720d89e88fa044deff.exe	28

C:\Users\Admin\AppData\Local\Temp\967e322618cd34720d89e88fa044deff.exe
"C:\Users\Admin\AppData\Local\Temp\967e322618cd34720d89e88fa044deff.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 512
  2⤵
  PID:1832

memory/2060-0-0x000000013F790000-0x000000013F7AA000-memory.dmp

Filesize
104KB

Download
memory/2060-1-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-2-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download