28f475199a10f1624ef690c53324614c28b8abd7b9e8db3c9e3eafbaf7ad303b

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 16:20

Target

cbdd12e77876d68504b575ea2fb546a7.exe
Size

9KB
MD5

cbdd12e77876d68504b575ea2fb546a7
SHA1

b9c622ae1497783312d1e54f76101a93069b20de
SHA256

28f475199a10f1624ef690c53324614c28b8abd7b9e8db3c9e3eafbaf7ad303b
SHA512

486b1fc35ff234c6b42d2d27e66b486b2793771981df478f7c6aad6fe8176dfc4d3f654cca2aa72845125f4ffe9f46a932bbfe8a2f448b2642b5f974874c19d5
SSDEEP

192:cBksuzPY82gQv5F4CtVeMZZ3NA93VnjdwCz63s5Zl:c82l4CtVeMhQFnhwCeWZ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	cbdd12e77876d68504b575ea2fb546a7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3008	1696	cbdd12e77876d68504b575ea2fb546a7.exe	28
PID 1696 wrote to memory of 3008	1696	cbdd12e77876d68504b575ea2fb546a7.exe	28
PID 1696 wrote to memory of 3008	1696	cbdd12e77876d68504b575ea2fb546a7.exe	28

C:\Users\Admin\AppData\Local\Temp\cbdd12e77876d68504b575ea2fb546a7.exe
"C:\Users\Admin\AppData\Local\Temp\cbdd12e77876d68504b575ea2fb546a7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1696 -s 904
  2⤵
  PID:3008

memory/1696-0-0x0000000000BD0000-0x0000000000BD8000-memory.dmp

Filesize
32KB

Download
memory/1696-1-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/1696-2-0x000000001B3B0000-0x000000001B430000-memory.dmp

Filesize
512KB

Download
memory/1696-3-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/1696-4-0x000000001B3B0000-0x000000001B430000-memory.dmp

Filesize
512KB

Download