cf35bb2494d4f140c790651592ecef8afc3086383f860611a3df6025bce9e307

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 01:31

Target

9822e37b127167b7ac8700d5268bc912.exe
Size

9KB
MD5

9822e37b127167b7ac8700d5268bc912
SHA1

c6dced35ac84b9b24e634cbbd013b527515e2578
SHA256

cf35bb2494d4f140c790651592ecef8afc3086383f860611a3df6025bce9e307
SHA512

b36e956e7cecb9a363744110b052690959f6aa294e9efb702080942573646993a6196148109d60699d059e22db65857a75d82affa2a55047ca3b58aec2d64740
SSDEEP

192:FBksuz9MuIK2eMZZ3A93VnjdwqzT3E2TIzK:Klf2eMEFnhwqPU2TIz

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	9822e37b127167b7ac8700d5268bc912.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3052	2368	9822e37b127167b7ac8700d5268bc912.exe	28
PID 2368 wrote to memory of 3052	2368	9822e37b127167b7ac8700d5268bc912.exe	28
PID 2368 wrote to memory of 3052	2368	9822e37b127167b7ac8700d5268bc912.exe	28

C:\Users\Admin\AppData\Local\Temp\9822e37b127167b7ac8700d5268bc912.exe
"C:\Users\Admin\AppData\Local\Temp\9822e37b127167b7ac8700d5268bc912.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 892
  2⤵
  PID:3052

memory/2368-0-0x0000000000960000-0x0000000000968000-memory.dmp

Filesize
32KB

Download
memory/2368-1-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-2-0x0000000001F30000-0x0000000001FB0000-memory.dmp

Filesize
512KB

Download
memory/2368-3-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

Filesize
9.9MB

Download
memory/2368-4-0x0000000001F30000-0x0000000001FB0000-memory.dmp

Filesize
512KB

Download