ad6dde941edba34915c6ef044ad0dd7be41c464c75257d06b7913ba0b8745a65

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 16:20

Target

b521a60064e0c238c40b40c6f5cc50de.exe
Size

9KB
MD5

b521a60064e0c238c40b40c6f5cc50de
SHA1

589d04b81a3f12865e18d63264a72e81839603d8
SHA256

ad6dde941edba34915c6ef044ad0dd7be41c464c75257d06b7913ba0b8745a65
SHA512

ba2cffae4b9e503143711f8f983c4a7a0fa5109784d7c583bf8632b106318159f5b549b49275786fba6169e28c485561c4a5dbcf933700c5b1829197e9e2b271
SSDEEP

192:GBksurzHNQpRPeMZZ3N593Vnjdwqz63p3rupDb:FHORPeMBvFnhwqmEpD

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	b521a60064e0c238c40b40c6f5cc50de.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2368	2956	b521a60064e0c238c40b40c6f5cc50de.exe	30
PID 2956 wrote to memory of 2368	2956	b521a60064e0c238c40b40c6f5cc50de.exe	30
PID 2956 wrote to memory of 2368	2956	b521a60064e0c238c40b40c6f5cc50de.exe	30

C:\Users\Admin\AppData\Local\Temp\b521a60064e0c238c40b40c6f5cc50de.exe
"C:\Users\Admin\AppData\Local\Temp\b521a60064e0c238c40b40c6f5cc50de.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 896
  2⤵
  PID:2368

memory/2956-0-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2956-1-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2956-2-0x000000001A6D0000-0x000000001A750000-memory.dmp

Filesize
512KB

Download
memory/2956-3-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2956-4-0x000000001A6D0000-0x000000001A750000-memory.dmp

Filesize
512KB

Download