02617b9442351d255cc5e9eb004257bc2b75dabec52af78fb55cf793f77f60d7

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 05:05

Target

c7c2b77e27e91fe45f21cb7b3d179bb7.exe
Size

9KB
MD5

c7c2b77e27e91fe45f21cb7b3d179bb7
SHA1

ce03822136224c461b626dca354272808aa0984f
SHA256

02617b9442351d255cc5e9eb004257bc2b75dabec52af78fb55cf793f77f60d7
SHA512

85ed881ec65d99a3178de569901b4999e5953d19b116fce7489d6b8cd3b9a3c28b7339358a4558b2e9571c9529e0b5db51bd40cdce3673cc25c6d78c9d5b5a0e
SSDEEP

192:uBksuDm6N7oy1NHCeMZZ3093Vnjdwqz23FRcC:w4xrCeMoFnhwqy7c

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	c7c2b77e27e91fe45f21cb7b3d179bb7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2660	1396	c7c2b77e27e91fe45f21cb7b3d179bb7.exe	28
PID 1396 wrote to memory of 2660	1396	c7c2b77e27e91fe45f21cb7b3d179bb7.exe	28
PID 1396 wrote to memory of 2660	1396	c7c2b77e27e91fe45f21cb7b3d179bb7.exe	28

C:\Users\Admin\AppData\Local\Temp\c7c2b77e27e91fe45f21cb7b3d179bb7.exe
"C:\Users\Admin\AppData\Local\Temp\c7c2b77e27e91fe45f21cb7b3d179bb7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1396 -s 896
  2⤵
  PID:2660

memory/1396-0-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/1396-1-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/1396-2-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/1396-3-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/1396-4-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download