7df24eb20a6d5af7f73490ba98ad5851dfd158c3838d833a7a6d0017cb97c156

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 07:03

Target

c545a50a45e6e5bf4099aefb20530cfc.exe
Size

9KB
MD5

c545a50a45e6e5bf4099aefb20530cfc
SHA1

149c0ba38a88819baa5085b99201e55088a317b6
SHA256

7df24eb20a6d5af7f73490ba98ad5851dfd158c3838d833a7a6d0017cb97c156
SHA512

29c6cd6192fb94eb9d08187cb43eced652d0fdd15b819207128f3f863d238bc7ece842fed36a982cc4a28dc4831a4d561af2d59e75e55d5592b8a79ca6d4c840
SSDEEP

192:oBksuzPY82gQv5F4oHtdeMZZ3un93VnjdwCz03Gl1G:w82l4itdeMOFnhwCg2X

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	c545a50a45e6e5bf4099aefb20530cfc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2796	1296	c545a50a45e6e5bf4099aefb20530cfc.exe	28
PID 1296 wrote to memory of 2796	1296	c545a50a45e6e5bf4099aefb20530cfc.exe	28
PID 1296 wrote to memory of 2796	1296	c545a50a45e6e5bf4099aefb20530cfc.exe	28

C:\Users\Admin\AppData\Local\Temp\c545a50a45e6e5bf4099aefb20530cfc.exe
"C:\Users\Admin\AppData\Local\Temp\c545a50a45e6e5bf4099aefb20530cfc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1296 -s 888
  2⤵
  PID:2796

memory/1296-0-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

Filesize
32KB

Download
memory/1296-1-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp

Filesize
9.9MB

Download
memory/1296-2-0x000000001B0C0000-0x000000001B140000-memory.dmp

Filesize
512KB

Download
memory/1296-3-0x000007FEF5CB0000-0x000007FEF669C000-memory.dmp

Filesize
9.9MB

Download
memory/1296-4-0x000000001B0C0000-0x000000001B140000-memory.dmp

Filesize
512KB

Download