83651278d52f4448010efb3fc9b52c8cdcf8f80db550527666f91e9c36a1e987

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 11:08

Target

c06fcab49ceed7d083d52e9fb52e3f04.exe
Size

9KB
MD5

c06fcab49ceed7d083d52e9fb52e3f04
SHA1

fa6bfeac335b2f34c6f774fde42193611251d64f
SHA256

83651278d52f4448010efb3fc9b52c8cdcf8f80db550527666f91e9c36a1e987
SHA512

1511d960c509ce598b76b24ea4e54b59858261cf306e9b74124462660c5b3689a73ad3fa866de4fa520f15e9c1d1ac51683c578421f844950825aa2b4e6f4d77
SSDEEP

192:bBksu/EXVwV/FeMZZ3m93VnjdwCzA3AOU:JVwtFeMSFnhwCMwO

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	c06fcab49ceed7d083d52e9fb52e3f04.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2180	2912	c06fcab49ceed7d083d52e9fb52e3f04.exe	28
PID 2912 wrote to memory of 2180	2912	c06fcab49ceed7d083d52e9fb52e3f04.exe	28
PID 2912 wrote to memory of 2180	2912	c06fcab49ceed7d083d52e9fb52e3f04.exe	28

C:\Users\Admin\AppData\Local\Temp\c06fcab49ceed7d083d52e9fb52e3f04.exe
"C:\Users\Admin\AppData\Local\Temp\c06fcab49ceed7d083d52e9fb52e3f04.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2912 -s 892
  2⤵
  PID:2180

memory/2912-0-0x00000000010C0000-0x00000000010C8000-memory.dmp

Filesize
32KB

Download
memory/2912-1-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-2-0x000000001B260000-0x000000001B2E0000-memory.dmp

Filesize
512KB

Download
memory/2912-3-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-4-0x000000001B260000-0x000000001B2E0000-memory.dmp

Filesize
512KB

Download