1509db56062fad0a68c96aa84caaac90240b9235e180263f4876af1113d5d506

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 16:25

Target

KEY FRP TOOL V1.1/KEY FRP TOOL V1.1.exe
Size

3.6MB
MD5

5e60732ee1e5e05f3f217e0eab2c40c7
SHA1

837c22b654d7ec99acc4538b05f2f9cacfdfea2b
SHA256

911760b1c3ef15303e4c27ff1d20bec157e5c4e724d8b87c8fc9b0d2e4ec79bf
SHA512

95aefec2cd9e0cf5992bb2059bac1188436969a4e30c44b79fea50c55adf61d7969df7906f0df7b88bf2af5bf463ce5456d7f9087f36d0dfc4319a0f800b118e
SSDEEP

49152:3USzUm0XSN5EasMTL/TTQ8gWYDnLISIGEBpZ2TIup1vGvHPeJkVg9hYjB1L0:3USYm0jas8/wZWKnLISWpKRGnP4sX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1288	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	KEY FRP TOOL V1.1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1700	1288	KEY FRP TOOL V1.1.exe	28
PID 1288 wrote to memory of 1700	1288	KEY FRP TOOL V1.1.exe	28
PID 1288 wrote to memory of 1700	1288	KEY FRP TOOL V1.1.exe	28
PID 1288 wrote to memory of 1700	1288	KEY FRP TOOL V1.1.exe	28

C:\Users\Admin\AppData\Local\Temp\KEY FRP TOOL V1.1\KEY FRP TOOL V1.1.exe
"C:\Users\Admin\AppData\Local\Temp\KEY FRP TOOL V1.1\KEY FRP TOOL V1.1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 636
  2⤵
  - Program crash
  PID:1700

memory/1288-0-0x0000000000350000-0x00000000006EA000-memory.dmp

Filesize
3.6MB

Download
memory/1288-1-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/1288-2-0x0000000005010000-0x0000000005050000-memory.dmp

Filesize
256KB

Download
memory/1288-3-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/1288-4-0x0000000005010000-0x0000000005050000-memory.dmp

Filesize
256KB

Download