a84e1adee4e3a6d94bc38e9dd53e51019cfc96e3348b0f7577dbb24f5d2d672d

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 11:41

Target

b74f693b9fdebf398f249dfe893c579b.exe
Size

9KB
MD5

b74f693b9fdebf398f249dfe893c579b
SHA1

59e0a62b22ac9320ed608f90b7aa845d15717c7b
SHA256

a84e1adee4e3a6d94bc38e9dd53e51019cfc96e3348b0f7577dbb24f5d2d672d
SHA512

9bac0b8642b81bc86fb113f49c9c6ba9f2433f2b2c69af124d94e33eeb0e77a3e11c145497c0940f038207150c63c3a2282f3ec423c5be6e7e729e18a08644b5
SSDEEP

192:pBksuDzHNQ18eMZZ3Y93Vnjdwqz3311m1h:uHS8eMkFnhwqL8

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	b74f693b9fdebf398f249dfe893c579b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2580	1400	b74f693b9fdebf398f249dfe893c579b.exe	30
PID 1400 wrote to memory of 2580	1400	b74f693b9fdebf398f249dfe893c579b.exe	30
PID 1400 wrote to memory of 2580	1400	b74f693b9fdebf398f249dfe893c579b.exe	30

C:\Users\Admin\AppData\Local\Temp\b74f693b9fdebf398f249dfe893c579b.exe
"C:\Users\Admin\AppData\Local\Temp\b74f693b9fdebf398f249dfe893c579b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1400 -s 896
  2⤵
  PID:2580

memory/1400-0-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/1400-1-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download
memory/1400-2-0x000000001B250000-0x000000001B2D0000-memory.dmp

Filesize
512KB

Download
memory/1400-3-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download
memory/1400-4-0x000000001B250000-0x000000001B2D0000-memory.dmp

Filesize
512KB

Download