f73adcc11842bd5ef761533db675431050b91217c961e43279294f0d44a898f8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 04:57

Target

b690cd49752ce4b77717c238682fc14c.exe
Size

9KB
MD5

b690cd49752ce4b77717c238682fc14c
SHA1

d4d9cd77650c9098d29f77fb16103e8538250e3c
SHA256

f73adcc11842bd5ef761533db675431050b91217c961e43279294f0d44a898f8
SHA512

98f32cd9deed532c3980ebca4444b4ba2e7fd6a02131891f49dad9750965f25e8d2384c46b0b46935c3dc7dc24bc55805ef2aef1dc6810a180dc6cd13c11eb7a
SSDEEP

192:dBksuXzHNQIReMZZ3393VnjdwqzT3tKgCkmla:2HHReMRFnhwq/dRCkml

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	b690cd49752ce4b77717c238682fc14c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2876	2184	b690cd49752ce4b77717c238682fc14c.exe	28
PID 2184 wrote to memory of 2876	2184	b690cd49752ce4b77717c238682fc14c.exe	28
PID 2184 wrote to memory of 2876	2184	b690cd49752ce4b77717c238682fc14c.exe	28

C:\Users\Admin\AppData\Local\Temp\b690cd49752ce4b77717c238682fc14c.exe
"C:\Users\Admin\AppData\Local\Temp\b690cd49752ce4b77717c238682fc14c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2184 -s 892
  2⤵
  PID:2876

memory/2184-0-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Filesize
32KB

Download
memory/2184-1-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2184-2-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download
memory/2184-3-0x000007FEF6080000-0x000007FEF6A6C000-memory.dmp

Filesize
9.9MB

Download
memory/2184-4-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download