937e83787a3874dd2745982e5f9dfbf1d10357304902d3eb630571819c0dccd5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 12:49

Target

e1b487dcfa3e587c523b58602c9bf685.exe
Size

9KB
MD5

e1b487dcfa3e587c523b58602c9bf685
SHA1

addcfe7dec7b499610a576c20b37caad2f263b8a
SHA256

937e83787a3874dd2745982e5f9dfbf1d10357304902d3eb630571819c0dccd5
SHA512

e137c3db1ee779165398bee2cfab669fb8c913a927940b86d3b6528a32725312b61d376a5ac1dd5425dafcfdb9e18cd575e6264ca066a0ce198ca51aef290373
SSDEEP

192:9BksuXrN3y+4XeMZZ3i93VnjdwCzF3HALaXnDv:6ZmXeMeFnhwChwLA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	e1b487dcfa3e587c523b58602c9bf685.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2740	1996	e1b487dcfa3e587c523b58602c9bf685.exe	28
PID 1996 wrote to memory of 2740	1996	e1b487dcfa3e587c523b58602c9bf685.exe	28
PID 1996 wrote to memory of 2740	1996	e1b487dcfa3e587c523b58602c9bf685.exe	28

C:\Users\Admin\AppData\Local\Temp\e1b487dcfa3e587c523b58602c9bf685.exe
"C:\Users\Admin\AppData\Local\Temp\e1b487dcfa3e587c523b58602c9bf685.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 888
  2⤵
  PID:2740

memory/1996-0-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/1996-1-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/1996-2-0x000000001B2B0000-0x000000001B330000-memory.dmp

Filesize
512KB

Download
memory/1996-3-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp

Filesize
9.9MB

Download
memory/1996-4-0x000000001B2B0000-0x000000001B330000-memory.dmp

Filesize
512KB

Download