bfcb4b53bf06076df371544ea2c31bcbc60369d3164c83a28b10f9c2723ff6af

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 13:44

Target

c8c153fd5d7e3e3a4d7428b99a20a5e1.exe
Size

9KB
MD5

c8c153fd5d7e3e3a4d7428b99a20a5e1
SHA1

4cbc30be0b6568acec569688a6195a7488a93014
SHA256

bfcb4b53bf06076df371544ea2c31bcbc60369d3164c83a28b10f9c2723ff6af
SHA512

9e2af5c06de0c5b31d13ad93b6b60e4cf5581467ad7abd471ff54c764171fc7a9031e9ed0ac8f5f88cb6915baa3d8ad19899d6f692f624485e69775cbb9241eb
SSDEEP

192:sBksu7EXVwVPTeMZZ3493VnjdwCzP3WLWJ:oVwRTeM8FnhwCTAW

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	c8c153fd5d7e3e3a4d7428b99a20a5e1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2584	2060	c8c153fd5d7e3e3a4d7428b99a20a5e1.exe	28
PID 2060 wrote to memory of 2584	2060	c8c153fd5d7e3e3a4d7428b99a20a5e1.exe	28
PID 2060 wrote to memory of 2584	2060	c8c153fd5d7e3e3a4d7428b99a20a5e1.exe	28

C:\Users\Admin\AppData\Local\Temp\c8c153fd5d7e3e3a4d7428b99a20a5e1.exe
"C:\Users\Admin\AppData\Local\Temp\c8c153fd5d7e3e3a4d7428b99a20a5e1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 900
  2⤵
  PID:2584

memory/2060-0-0x0000000000D70000-0x0000000000D78000-memory.dmp

Filesize
32KB

Download
memory/2060-1-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2060-2-0x000000001B370000-0x000000001B3F0000-memory.dmp

Filesize
512KB

Download
memory/2060-3-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2060-4-0x000000001B370000-0x000000001B3F0000-memory.dmp

Filesize
512KB

Download