f2d994e46111b4c1bfa6b87c4c2c05209788473ad447f5ddff496e24100cebb1

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 23:04

Target

aa629cb48203bc86e82237e921a5cf90.exe
Size

9KB
MD5

aa629cb48203bc86e82237e921a5cf90
SHA1

1a92fc096e0edf60f7ee8f3c8dbce4ca28b6e83a
SHA256

f2d994e46111b4c1bfa6b87c4c2c05209788473ad447f5ddff496e24100cebb1
SHA512

079600ec1dc390f2588554db581a7d47b545f83425583b337991ca86c0a50a4df37fdf7fb77d597e0169d1eb90cce09cc785ac91b150d6514afdb9fd318ad585
SSDEEP

192:WBksunPY82gQv5F4s3tdeMZZ3e93VnjdwCzX3P/omABT:i82l40tdeMKFnhwCLImE

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	aa629cb48203bc86e82237e921a5cf90.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2612	2764	aa629cb48203bc86e82237e921a5cf90.exe	30
PID 2764 wrote to memory of 2612	2764	aa629cb48203bc86e82237e921a5cf90.exe	30
PID 2764 wrote to memory of 2612	2764	aa629cb48203bc86e82237e921a5cf90.exe	30

C:\Users\Admin\AppData\Local\Temp\aa629cb48203bc86e82237e921a5cf90.exe
"C:\Users\Admin\AppData\Local\Temp\aa629cb48203bc86e82237e921a5cf90.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2764 -s 900
  2⤵
  PID:2612

memory/2764-0-0x0000000001040000-0x0000000001048000-memory.dmp

Filesize
32KB

Download
memory/2764-1-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-2-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/2764-3-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-4-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download