249da61c7608dcc3eb85eeeac464d4f80e2f199fd6568f3bcdc5c1f0ae8d2286

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 17:23

Target

dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe
Size

9KB
MD5

dfb43dfbc0bf18d8d5a72aaea86d3ea4
SHA1

0e4285b448acd02d4e4a4f9326083bbddca7d80e
SHA256

249da61c7608dcc3eb85eeeac464d4f80e2f199fd6568f3bcdc5c1f0ae8d2286
SHA512

6e9c65edb19c43f02cc9b10cdd4b3254624f8382d9e872805d5c12a64a3450e8c14ffd003d1f6088a7ca19cabde215e8863c7c2dce89b5bdf3d8293b417e94b9
SSDEEP

192:SBksuz9MuI5GeMZZ3093Vnjdwqzh3MlYnWv:bl4GeM4Fnhwq98qW

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2868	2956	dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe	30
PID 2956 wrote to memory of 2868	2956	dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe	30
PID 2956 wrote to memory of 2868	2956	dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe	30

C:\Users\Admin\AppData\Local\Temp\dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe
"C:\Users\Admin\AppData\Local\Temp\dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 904
  2⤵
  PID:2868

memory/2956-0-0x0000000000900000-0x0000000000908000-memory.dmp

Filesize
32KB

Download
memory/2956-1-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2956-2-0x000000001B4F0000-0x000000001B570000-memory.dmp

Filesize
512KB

Download
memory/2956-3-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2956-4-0x000000001B4F0000-0x000000001B570000-memory.dmp

Filesize
512KB

Download