9fa043fffcc43ae2c0870fa0af519134c93d26ee089464b1491644c0c5850290

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 12:12

Target

e1a305a1c36844a8e43d606d685e5f4a.exe
Size

9KB
MD5

e1a305a1c36844a8e43d606d685e5f4a
SHA1

15a7c3787d223328a8979b562b5027da31fd0bb2
SHA256

9fa043fffcc43ae2c0870fa0af519134c93d26ee089464b1491644c0c5850290
SHA512

bc826bb1464bfb4fbb830396db694da1a386c05c9641b78a8f686a66b448e360ca710b86605ee79afc98ff62fc8e6e2e3fadac2a70478a13d0609fa746ee39a5
SSDEEP

192:WBksuzPY82gQv5F42tIeMZZ3N93VnjdwCzz3MWRefH6:u82l42tIeMfFnhwCfUfH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	e1a305a1c36844a8e43d606d685e5f4a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2408	2776	e1a305a1c36844a8e43d606d685e5f4a.exe	30
PID 2776 wrote to memory of 2408	2776	e1a305a1c36844a8e43d606d685e5f4a.exe	30
PID 2776 wrote to memory of 2408	2776	e1a305a1c36844a8e43d606d685e5f4a.exe	30

C:\Users\Admin\AppData\Local\Temp\e1a305a1c36844a8e43d606d685e5f4a.exe
"C:\Users\Admin\AppData\Local\Temp\e1a305a1c36844a8e43d606d685e5f4a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 904
  2⤵
  PID:2408

memory/2776-0-0x0000000001290000-0x0000000001298000-memory.dmp

Filesize
32KB

Download
memory/2776-1-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-2-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download
memory/2776-3-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2776-4-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download