2fc8db63c2ce5d35dce520de8678d48d4745bfab00e00f8c66b39e6d38a30849

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:48

Target

9a8fa781573d1afd3f83dbf0bcdf01ae.exe
Size

9KB
MD5

9a8fa781573d1afd3f83dbf0bcdf01ae
SHA1

0b8852136c0fc7bb2188ddd0447c00ea4ec5a3b3
SHA256

2fc8db63c2ce5d35dce520de8678d48d4745bfab00e00f8c66b39e6d38a30849
SHA512

1e1b2af5ae6b027b41eb0f42d57e83dad5f22217db6df7eadb34fc5374dabc6885893f0f15eeb28012d738248ae5712606fc2906ece01258be171e46e735f46b
SSDEEP

192:Q5BksuDEXVwVVHKeMZZ3z93VnjdwCz336Oh8cj:QrVwjKeM9FnhwCTGc

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	9a8fa781573d1afd3f83dbf0bcdf01ae.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2784	2084	9a8fa781573d1afd3f83dbf0bcdf01ae.exe	28
PID 2084 wrote to memory of 2784	2084	9a8fa781573d1afd3f83dbf0bcdf01ae.exe	28
PID 2084 wrote to memory of 2784	2084	9a8fa781573d1afd3f83dbf0bcdf01ae.exe	28

C:\Users\Admin\AppData\Local\Temp\9a8fa781573d1afd3f83dbf0bcdf01ae.exe
"C:\Users\Admin\AppData\Local\Temp\9a8fa781573d1afd3f83dbf0bcdf01ae.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2084 -s 892
  2⤵
  PID:2784

memory/2084-0-0x0000000000E70000-0x0000000000E78000-memory.dmp

Filesize
32KB

Download
memory/2084-1-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/2084-2-0x000000001B480000-0x000000001B500000-memory.dmp

Filesize
512KB

Download
memory/2084-3-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/2084-4-0x000000001B480000-0x000000001B500000-memory.dmp

Filesize
512KB

Download