ef353462f62b510483e6208c91c80fd489fc81cc4bf6362e2b611aefb5c4d56f

Analysis

max time kernel
1556s
max time network
1557s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 03:08

Target
DwmLutGUI.exe
Size 41KB
Sample240220-dndreaae88
SHA256 5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280
MD5 3b4757e1a391ad8afe84a433ea044335
SHA1 1d04873b685e26377ed7be16f1dea43f149dd07e
SHA512 a4f95040ebb2839b6f87dacd687e22110e6f02c5a7032f4d9645c20b4bfe58cd8fb39eec9e1c59f4cb7fb6e6a23aa89e06d16713fa5fed337f0b192353574a3a
SSDEEP 768:Xu3QbzTyrqZmr3dYzBA9dMFciV5yQIXXFABQJVDDDDDRVDDDDDsetYcFwVc6K:XaQXurqZmr3dEKjit5yQIXVABQ0iwVcl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	DwmLutGUI.exe
Token: SeDebugPrivilege	2520	DwmLutGUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2528	2520	DwmLutGUI.exe	28
PID 2520 wrote to memory of 2528	2520	DwmLutGUI.exe	28
PID 2520 wrote to memory of 2528	2520	DwmLutGUI.exe	28

C:\Users\Admin\AppData\Local\Temp\DwmLutGUI.exe
"C:\Users\Admin\AppData\Local\Temp\DwmLutGUI.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 688
  2⤵
  PID:2528

memory/2520-0-0x000000013FB60000-0x000000013FB6E000-memory.dmp

Download

memory/2520-1-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Download

memory/2520-2-0x000000001B6A0000-0x000000001B720000-memory.dmp

Download

memory/2520-3-0x0000000000940000-0x0000000000956000-memory.dmp

Download

memory/2520-4-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

Download