102711e5ac34aa67a67b37ec0a26335b743d216a48057d06814be67d46adf161

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 08:39

Target

ab77a4cce285ecd13456546ea9a40b38.exe
Size

9KB
MD5

ab77a4cce285ecd13456546ea9a40b38
SHA1

05c836d92036c4c50ad8c2cb9c29f07bbafd06fa
SHA256

102711e5ac34aa67a67b37ec0a26335b743d216a48057d06814be67d46adf161
SHA512

0ed6ea1996ec5ac0fa5fa5ea436f40b1d265008c54a3ea640df5d87c4dbe1d110463c67fa62e4ab16eb4210dfaceb232976150fc0093015f948792486c5b5456
SSDEEP

192:gBksuDzHNQpGeMZZ3q93VnjdwqzE3rJ/9wDWG:7HyGeM+Fnhwqgbzp

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	ab77a4cce285ecd13456546ea9a40b38.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2624	1852	ab77a4cce285ecd13456546ea9a40b38.exe	28
PID 1852 wrote to memory of 2624	1852	ab77a4cce285ecd13456546ea9a40b38.exe	28
PID 1852 wrote to memory of 2624	1852	ab77a4cce285ecd13456546ea9a40b38.exe	28

C:\Users\Admin\AppData\Local\Temp\ab77a4cce285ecd13456546ea9a40b38.exe
"C:\Users\Admin\AppData\Local\Temp\ab77a4cce285ecd13456546ea9a40b38.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1852 -s 900
  2⤵
  PID:2624

memory/1852-0-0x0000000000820000-0x0000000000828000-memory.dmp

Filesize
32KB

Download
memory/1852-1-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/1852-2-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download
memory/1852-3-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/1852-4-0x000000001B300000-0x000000001B380000-memory.dmp

Filesize
512KB

Download