da5eab21b55e54b8ad531f8a3c7581958252606db9400801a43bf3ee584a8626

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 08:42

Target

c5718696942449b2c71ba4b41cb9982e.exe
Size

9KB
MD5

c5718696942449b2c71ba4b41cb9982e
SHA1

58b1ee9b1effa44d201b63077877687873c6fec9
SHA256

da5eab21b55e54b8ad531f8a3c7581958252606db9400801a43bf3ee584a8626
SHA512

acf4dfdde42e090099563ee03cc8a396f53a988681b5a2df4edd3d3d01525f330e8d5c6ffce9ec485719ef68ab727012b21ab018efb97e8b585727022c8d2225
SSDEEP

192:tBksu7zHNQyBeMZZ3X93Vnjdwqzg3lo7k7:aHlBeMBFnhwqk+k

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	c5718696942449b2c71ba4b41cb9982e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2588	1732	c5718696942449b2c71ba4b41cb9982e.exe	28
PID 1732 wrote to memory of 2588	1732	c5718696942449b2c71ba4b41cb9982e.exe	28
PID 1732 wrote to memory of 2588	1732	c5718696942449b2c71ba4b41cb9982e.exe	28

C:\Users\Admin\AppData\Local\Temp\c5718696942449b2c71ba4b41cb9982e.exe
"C:\Users\Admin\AppData\Local\Temp\c5718696942449b2c71ba4b41cb9982e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 896
  2⤵
  PID:2588

memory/1732-0-0x00000000009A0000-0x00000000009A8000-memory.dmp

Filesize
32KB

Download
memory/1732-1-0x000007FEF50D0000-0x000007FEF5ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1732-2-0x000000001B030000-0x000000001B0B0000-memory.dmp

Filesize
512KB

Download
memory/1732-3-0x000007FEF50D0000-0x000007FEF5ABC000-memory.dmp

Filesize
9.9MB

Download
memory/1732-4-0x000000001B030000-0x000000001B0B0000-memory.dmp

Filesize
512KB

Download