1d6628e73d14b7925b2a93e1df212ee1a939865c6deb694bfa6da8dc4d41ef71

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 03:19

Target

ccf92d8c1f2105b93ddd450f16ead6ab.exe
Size

36KB
MD5

ccf92d8c1f2105b93ddd450f16ead6ab
SHA1

a2a2f0049581dc4d5d1634d31b5ac394b36009b8
SHA256

1d6628e73d14b7925b2a93e1df212ee1a939865c6deb694bfa6da8dc4d41ef71
SHA512

2b68dbc267e253ca1ebfc8a8900a012dc15af79be838e410e29b72fac737f8238e1b8833a54153895e30fd045092f27492ae08addc0447b06ce894a9ee398af3
SSDEEP

384:PEjFbs4d/qfPMvzjrDosga3h1urN1RsdaWaqK0l0OrDkgjFk:PEjt9dSXYzfco81adaCHjkgq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2964	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	ccf92d8c1f2105b93ddd450f16ead6ab.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1988	2964	ccf92d8c1f2105b93ddd450f16ead6ab.exe	28
PID 2964 wrote to memory of 1988	2964	ccf92d8c1f2105b93ddd450f16ead6ab.exe	28
PID 2964 wrote to memory of 1988	2964	ccf92d8c1f2105b93ddd450f16ead6ab.exe	28
PID 2964 wrote to memory of 1988	2964	ccf92d8c1f2105b93ddd450f16ead6ab.exe	28

C:\Users\Admin\AppData\Local\Temp\ccf92d8c1f2105b93ddd450f16ead6ab.exe
"C:\Users\Admin\AppData\Local\Temp\ccf92d8c1f2105b93ddd450f16ead6ab.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 800
  2⤵
  - Program crash
  PID:1988