253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 02:04

Target

253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a.exe
Size

122KB
MD5

832b330b974c4f89a4de8a78259a83a6
SHA1

66567e52e22592c51f9e7861b1ebc62ebf0d575f
SHA256

253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a
SHA512

43a99b2de60b84d554ea34c5e8abef1982f9f89e408a1ff514982cb63c5e833d7b2d9ac88cb89adab046dc4e69d883a125424ed907bc1c3e8ab1698f299fcb2e
SSDEEP

3072:1cgiS0h0CTXYmvFMQ4b1Lf4s/qMiShFq8ucyZ07Vr7+7:16S0hYmuQ4pfPSMiShs6yy71y7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2484	1712	253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a.exe	28
PID 1712 wrote to memory of 2484	1712	253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a.exe	28
PID 1712 wrote to memory of 2484	1712	253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a.exe	28

C:\Users\Admin\AppData\Local\Temp\253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a.exe
"C:\Users\Admin\AppData\Local\Temp\253da717bf5b35fe418be01ce5b012d6883f9ae70b4a44d58f03c39657e4460a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1712 -s 1448
  2⤵
  PID:2484

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61E5.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/1712-0-0x0000000000B00000-0x0000000000B18000-memory.dmp

Filesize
96KB

Download
memory/1712-1-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/1712-2-0x000000001AEF0000-0x000000001AF70000-memory.dmp

Filesize
512KB

Download
memory/1712-3-0x0000000000150000-0x0000000000158000-memory.dmp

Filesize
32KB

Download
memory/1712-61-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/1712-62-0x000000001AEF0000-0x000000001AF70000-memory.dmp

Filesize
512KB

Download