28e904fd216f1fa26962fa9ca0be1bf2bdb1043b72fad7fd56824aa383d4a465

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 13:14

Target

Fluxus/Fluxus V7.exe
Size

3.9MB
MD5

aa5d196260f56a93d7a9ddf32d202112
SHA1

4abe547da7e38e9facb98523e4795a71af6b4600
SHA256

653eaa58999ff72cd9e858a9661c87b049fc66172d20fc9ae0f1e3b1e2af694b
SHA512

7cf76918a4d04c628cc4e7b3a7f2674c03b97104e98b98ab8407d2e12521e48dc61438d982cfdc9763deaa1b915e4432a972274dd6ac381a5a58f08e1ffd55d5
SSDEEP

49152:XgLIR9JyCns59qfuce05XlWycazyClY1YH8PnGpv80tbvvqVUcZ:XgLIRfyC7egWJa3lY1U82kmvvoUc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	3012	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	Fluxus V7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2592	3012	Fluxus V7.exe	28
PID 3012 wrote to memory of 2592	3012	Fluxus V7.exe	28
PID 3012 wrote to memory of 2592	3012	Fluxus V7.exe	28
PID 3012 wrote to memory of 2592	3012	Fluxus V7.exe	28

C:\Users\Admin\AppData\Local\Temp\Fluxus\Fluxus V7.exe
"C:\Users\Admin\AppData\Local\Temp\Fluxus\Fluxus V7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 1072
  2⤵
  - Program crash
  PID:2592

memory/3012-0-0x00000000001A0000-0x0000000000594000-memory.dmp

Filesize
4.0MB

Download
memory/3012-1-0x0000000074C00000-0x00000000752EE000-memory.dmp

Filesize
6.9MB

Download
memory/3012-2-0x00000000050C0000-0x0000000005100000-memory.dmp

Filesize
256KB

Download
memory/3012-3-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download
memory/3012-4-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download
memory/3012-5-0x00000000050C0000-0x0000000005100000-memory.dmp

Filesize
256KB

Download
memory/3012-6-0x0000000074C00000-0x00000000752EE000-memory.dmp

Filesize
6.9MB

Download
memory/3012-7-0x00000000050C0000-0x0000000005100000-memory.dmp

Filesize
256KB

Download
memory/3012-8-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download
memory/3012-9-0x00000000050C0000-0x0000000005100000-memory.dmp

Filesize
256KB

Download