cca02d2a8e61e6e87d868de21a38b918cb26abaa55da3e2b8f76d7ebdfd3de6a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 05:17

Target

a109e0c886d296962c7eb1e7d1184b2d.exe
Size

9KB
MD5

a109e0c886d296962c7eb1e7d1184b2d
SHA1

75ef5f6e7ab5fdd102499abde9770dcf005091ff
SHA256

cca02d2a8e61e6e87d868de21a38b918cb26abaa55da3e2b8f76d7ebdfd3de6a
SHA512

98326af18e4f254810d84a379cced7496a2583c3d5f0739390ff693cadf279080a211d00757a22af96688a21a566c5d74b49349e4e491fde2160e960eecc2c60
SSDEEP

192:8BksuDEXVwVbCeMZZ3n93VnjdwCzY/3NRGJ:QVwRCeMJFnhwC6fG

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	a109e0c886d296962c7eb1e7d1184b2d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2676	2020	a109e0c886d296962c7eb1e7d1184b2d.exe	28
PID 2020 wrote to memory of 2676	2020	a109e0c886d296962c7eb1e7d1184b2d.exe	28
PID 2020 wrote to memory of 2676	2020	a109e0c886d296962c7eb1e7d1184b2d.exe	28

C:\Users\Admin\AppData\Local\Temp\a109e0c886d296962c7eb1e7d1184b2d.exe
"C:\Users\Admin\AppData\Local\Temp\a109e0c886d296962c7eb1e7d1184b2d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2020 -s 896
  2⤵
  PID:2676

memory/2020-0-0x0000000000D70000-0x0000000000D78000-memory.dmp

Filesize
32KB

Download
memory/2020-1-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp

Filesize
9.9MB

Download
memory/2020-2-0x0000000000B30000-0x0000000000BB0000-memory.dmp

Filesize
512KB

Download
memory/2020-3-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp

Filesize
9.9MB

Download
memory/2020-4-0x0000000000B30000-0x0000000000BB0000-memory.dmp

Filesize
512KB

Download