da2df2fafb1ac63ea81c6d0082a94482b1177a7e34cf4f811d242ef058addc6e

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 19:15

Target

b5778847ecb28e5d3fb8e66f6ed04334.exe
Size

9KB
MD5

b5778847ecb28e5d3fb8e66f6ed04334
SHA1

b2939cbaf61ed45b0350b5c6a1dff56c0780030f
SHA256

da2df2fafb1ac63ea81c6d0082a94482b1177a7e34cf4f811d242ef058addc6e
SHA512

aa5c65d720b54e26a45197c1a77770b38ea21382c0fbf2aba078d2dcae20a24349d7397fea43675c843dbbaae170eac64b4ab98adf507a802cdf789aac93c734
SSDEEP

192:jBksunPY82gQv5F4nt0eMZZ3l93VnjdwCz53Ey1:d82l4nt0eMvFnhwCt1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	b5778847ecb28e5d3fb8e66f6ed04334.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2568	3024	b5778847ecb28e5d3fb8e66f6ed04334.exe	28
PID 3024 wrote to memory of 2568	3024	b5778847ecb28e5d3fb8e66f6ed04334.exe	28
PID 3024 wrote to memory of 2568	3024	b5778847ecb28e5d3fb8e66f6ed04334.exe	28

C:\Users\Admin\AppData\Local\Temp\b5778847ecb28e5d3fb8e66f6ed04334.exe
"C:\Users\Admin\AppData\Local\Temp\b5778847ecb28e5d3fb8e66f6ed04334.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 888
  2⤵
  PID:2568

memory/3024-0-0x00000000010D0000-0x00000000010D8000-memory.dmp

Filesize
32KB

Download
memory/3024-1-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-2-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download
memory/3024-3-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-4-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download