032185876f05ee92ea39feddce819321acb8c4600b5d580396a7e5e29fbc82de

Analysis

max time kernel
22s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 19:59

Target

66655.exe
Size

616KB
MD5

d3eefd47c4e9914b0628ce70eb8bc2d4
SHA1

e62be539433ebab0c86bd6838503fb7a8fed81a5
SHA256

032185876f05ee92ea39feddce819321acb8c4600b5d580396a7e5e29fbc82de
SHA512

5e6be0e425f38958b3a34a9e30ac41c68a90cb50b3f6a331e18864dbcd96c847f8455644d2cb22bb8eae662d35855ce1733093b3dae7cfd26c1a7cc83d7be4ce
SSDEEP

12288:1otU8AmKff8NWuJQnvv5Ehl3qRlWUFxuUN:1L8Am4f8NWuJQnH5Ehl3qlQUN

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	66655.exe
Token: SeShutdownPrivilege	2240	66655.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2212	2240	66655.exe	28
PID 2240 wrote to memory of 2212	2240	66655.exe	28
PID 2240 wrote to memory of 2212	2240	66655.exe	28

C:\Users\Admin\AppData\Local\Temp\66655.exe
"C:\Users\Admin\AppData\Local\Temp\66655.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 804
  2⤵
  PID:2212

memory/2240-0-0x0000000000CF0000-0x0000000000D8E000-memory.dmp

Filesize
632KB

Download
memory/2240-1-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2240-2-0x000000001AD00000-0x000000001AD80000-memory.dmp

Filesize
512KB

Download
memory/2240-3-0x00000000023E0000-0x00000000023FA000-memory.dmp

Filesize
104KB

Download
memory/2240-4-0x000000001AD00000-0x000000001AD80000-memory.dmp

Filesize
512KB

Download
memory/2240-5-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2240-6-0x000000001AD00000-0x000000001AD80000-memory.dmp

Filesize
512KB

Download
memory/2240-7-0x000000001AD00000-0x000000001AD80000-memory.dmp

Filesize
512KB

Download