6c70a819760f1c9b9f3822f8928691c9b8a5939e8ff2e9a824e8a2792b823cce

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 05:36

Target

ab20c6872e7c6c226a95453d1155f32e.exe
Size

9KB
MD5

ab20c6872e7c6c226a95453d1155f32e
SHA1

6f14cd3760e5db24454486edf7c64ae79c12b496
SHA256

6c70a819760f1c9b9f3822f8928691c9b8a5939e8ff2e9a824e8a2792b823cce
SHA512

e1b7eaa3f154241b6367a22c45758ac44188929d7507bb0aa82b9e76d4f890a258c6abfca115410c6d3a007fbb47a265bae6c640a432e850d59d938552616d5b
SSDEEP

192:TBksuDEXVwV2HeMZZ3w93VnjdwCze3XaFv:9VwQHeM8FnhwCKnaF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	ab20c6872e7c6c226a95453d1155f32e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1296	2912	ab20c6872e7c6c226a95453d1155f32e.exe	28
PID 2912 wrote to memory of 1296	2912	ab20c6872e7c6c226a95453d1155f32e.exe	28
PID 2912 wrote to memory of 1296	2912	ab20c6872e7c6c226a95453d1155f32e.exe	28

C:\Users\Admin\AppData\Local\Temp\ab20c6872e7c6c226a95453d1155f32e.exe
"C:\Users\Admin\AppData\Local\Temp\ab20c6872e7c6c226a95453d1155f32e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2912 -s 888
  2⤵
  PID:1296

memory/2912-0-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/2912-1-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-2-0x000000001AFC0000-0x000000001B040000-memory.dmp

Filesize
512KB

Download
memory/2912-3-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-4-0x000000001AFC0000-0x000000001B040000-memory.dmp

Filesize
512KB

Download