951506328467055d7ee01c3b3df40f78d6cc898b08fbf0c9bda7128272c44eaa

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 15:00

Target

b4fb9ae4436a943d3227c3e2a7cc2352.exe
Size

9KB
MD5

b4fb9ae4436a943d3227c3e2a7cc2352
SHA1

0e575c4d5606e958b5a98865dc18ffea462a3265
SHA256

951506328467055d7ee01c3b3df40f78d6cc898b08fbf0c9bda7128272c44eaa
SHA512

31be69110fbac7824b80a55b39e19358f32350b4feb6d51f0fd1d2626769d090c7d465bd751cbfbec786580860402f277dc1ab5fd0dd37652a6cd2a3b3fc4453
SSDEEP

192:HBksurEXVwVtSeMZZ3L93VnjdwCzE3Ii:BVwnSeMlFnhwCw4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	b4fb9ae4436a943d3227c3e2a7cc2352.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2152	1932	b4fb9ae4436a943d3227c3e2a7cc2352.exe	28
PID 1932 wrote to memory of 2152	1932	b4fb9ae4436a943d3227c3e2a7cc2352.exe	28
PID 1932 wrote to memory of 2152	1932	b4fb9ae4436a943d3227c3e2a7cc2352.exe	28

C:\Users\Admin\AppData\Local\Temp\b4fb9ae4436a943d3227c3e2a7cc2352.exe
"C:\Users\Admin\AppData\Local\Temp\b4fb9ae4436a943d3227c3e2a7cc2352.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1932 -s 900
  2⤵
  PID:2152

memory/1932-0-0x0000000000360000-0x0000000000368000-memory.dmp

Filesize
32KB

Download
memory/1932-1-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-2-0x000000001B490000-0x000000001B510000-memory.dmp

Filesize
512KB

Download
memory/1932-3-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-4-0x000000001B490000-0x000000001B510000-memory.dmp

Filesize
512KB

Download