266e152e54ce342de068456d8c1d4779975ba29fd9a0948f0a46a6284cff4890

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 10:24

Target

c5a22fbb08be34ccf0bd1784a98e319f.exe
Size

9KB
MD5

c5a22fbb08be34ccf0bd1784a98e319f
SHA1

e3ce18b17887c37d8c3b8e9228750fdd92b84a01
SHA256

266e152e54ce342de068456d8c1d4779975ba29fd9a0948f0a46a6284cff4890
SHA512

b5efe7cceb33659d5a84025be3621f8c4d605f2051bc09f76ea74a5e3fa80a7274fa18a11ed5063c4694348d793acacd6345c763ca6d698fd723dc0bb87ee563
SSDEEP

192:nONBksurm6N7oy1MGeMZZ3093Vnjdwqzg3vtbJNy:ne4xyGeMQFnhwq8ftbJN

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	c5a22fbb08be34ccf0bd1784a98e319f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2808	2200	c5a22fbb08be34ccf0bd1784a98e319f.exe	28
PID 2200 wrote to memory of 2808	2200	c5a22fbb08be34ccf0bd1784a98e319f.exe	28
PID 2200 wrote to memory of 2808	2200	c5a22fbb08be34ccf0bd1784a98e319f.exe	28

C:\Users\Admin\AppData\Local\Temp\c5a22fbb08be34ccf0bd1784a98e319f.exe
"C:\Users\Admin\AppData\Local\Temp\c5a22fbb08be34ccf0bd1784a98e319f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2200 -s 900
  2⤵
  PID:2808

memory/2200-0-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/2200-1-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2200-2-0x00000000002D0000-0x0000000000350000-memory.dmp

Filesize
512KB

Download
memory/2200-3-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2200-4-0x00000000002D0000-0x0000000000350000-memory.dmp

Filesize
512KB

Download