c032d13f64014588b267496b2a4a6af595691b89f256550815f84525029f1b9c

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 22:29

Target

a07f902cc869fbfd800afb2fd5199a39.exe
Size

9KB
MD5

a07f902cc869fbfd800afb2fd5199a39
SHA1

8c31bedf5e188035f0de3c0fa4fb841fbef634d1
SHA256

c032d13f64014588b267496b2a4a6af595691b89f256550815f84525029f1b9c
SHA512

d76d66eebdc7a18a4fb848e5c996b013349d51c9fb8528e38420139c03ff36710b6972da8c6d779316fc9e0ecaa11b863a727d5591932575bc26a60f9aab3f22
SSDEEP

192:FBksuDzHNQjxeMZZ3n93Vnjdwqzm3HS3x:6H4xeMxFnhwqS3S3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	a07f902cc869fbfd800afb2fd5199a39.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2876	1664	a07f902cc869fbfd800afb2fd5199a39.exe	30
PID 1664 wrote to memory of 2876	1664	a07f902cc869fbfd800afb2fd5199a39.exe	30
PID 1664 wrote to memory of 2876	1664	a07f902cc869fbfd800afb2fd5199a39.exe	30

C:\Users\Admin\AppData\Local\Temp\a07f902cc869fbfd800afb2fd5199a39.exe
"C:\Users\Admin\AppData\Local\Temp\a07f902cc869fbfd800afb2fd5199a39.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1664 -s 896
  2⤵
  PID:2876

memory/1664-0-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Filesize
32KB

Download
memory/1664-1-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1664-2-0x000000001B2C0000-0x000000001B340000-memory.dmp

Filesize
512KB

Download
memory/1664-3-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1664-4-0x000000001B2C0000-0x000000001B340000-memory.dmp

Filesize
512KB

Download