ef353462f62b510483e6208c91c80fd489fc81cc4bf6362e2b611aefb5c4d56f

Analysis

max time kernel
1556s
max time network
1557s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 03:08

Target

DwmLutGUI.exe
Size

41KB
MD5

3b4757e1a391ad8afe84a433ea044335
SHA1

1d04873b685e26377ed7be16f1dea43f149dd07e
SHA256

5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280
SHA512

a4f95040ebb2839b6f87dacd687e22110e6f02c5a7032f4d9645c20b4bfe58cd8fb39eec9e1c59f4cb7fb6e6a23aa89e06d16713fa5fed337f0b192353574a3a
SSDEEP

768:Xu3QbzTyrqZmr3dYzBA9dMFciV5yQIXXFABQJVDDDDDRVDDDDDsetYcFwVc6K:XaQXurqZmr3dEKjit5yQIXVABQ0iwVcl

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	DwmLutGUI.exe
Token: SeDebugPrivilege	2520	DwmLutGUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2528	2520	DwmLutGUI.exe	28
PID 2520 wrote to memory of 2528	2520	DwmLutGUI.exe	28
PID 2520 wrote to memory of 2528	2520	DwmLutGUI.exe	28

C:\Users\Admin\AppData\Local\Temp\DwmLutGUI.exe
"C:\Users\Admin\AppData\Local\Temp\DwmLutGUI.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 688
  2⤵
  PID:2528

memory/2520-0-0x000000013FB60000-0x000000013FB6E000-memory.dmp

Filesize
56KB

Download
memory/2520-1-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-2-0x000000001B6A0000-0x000000001B720000-memory.dmp

Filesize
512KB

Download
memory/2520-3-0x0000000000940000-0x0000000000956000-memory.dmp

Filesize
88KB

Download
memory/2520-4-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Filesize
9.9MB

Download