669ad58a4465e58c2b17de39a90f8fdc0f23b8661d587f9d123bed21565cdcb4

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 16:50

Target

cbecffad2ec959bb53d9d3ced0b833dd.exe
Size

34KB
MD5

cbecffad2ec959bb53d9d3ced0b833dd
SHA1

f626db3e526d78fa063e8d7608e482a50e4a44bf
SHA256

669ad58a4465e58c2b17de39a90f8fdc0f23b8661d587f9d123bed21565cdcb4
SHA512

546133f8f972aade86356459c2ad22f768d8a8f12f39bdcbfcf1867b52967f4b0c87dbd90048096635a438dfdae80c608a3577f3104db617cf26c5a0199104be
SSDEEP

384:f807CSAtoSxFzizRhWhUV/hBwE8QXgzDWkllKcdDLygtTa9c12P3+TI0RF+YchvI:f0DyVRhbV/hL8QwWGFDS+I+F+Ychg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2480	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	cbecffad2ec959bb53d9d3ced0b833dd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2500	2480	cbecffad2ec959bb53d9d3ced0b833dd.exe	28
PID 2480 wrote to memory of 2500	2480	cbecffad2ec959bb53d9d3ced0b833dd.exe	28
PID 2480 wrote to memory of 2500	2480	cbecffad2ec959bb53d9d3ced0b833dd.exe	28
PID 2480 wrote to memory of 2500	2480	cbecffad2ec959bb53d9d3ced0b833dd.exe	28

C:\Users\Admin\AppData\Local\Temp\cbecffad2ec959bb53d9d3ced0b833dd.exe
"C:\Users\Admin\AppData\Local\Temp\cbecffad2ec959bb53d9d3ced0b833dd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 980
  2⤵
  - Program crash
  PID:2500

memory/2480-0-0x00000000010C0000-0x00000000010CE000-memory.dmp

Filesize
56KB

Download
memory/2480-1-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2480-2-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download
memory/2480-4-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2480-5-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download