4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 01:15

Target

4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe
Size

418KB
MD5

0e7497072e238188baf61304e3d6719a
SHA1

6f45c46a6f781bf28b9dfee19c2664eda61525b3
SHA256

4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc
SHA512

6501269ba6e862e85ffad0d7749b61c22d83a58a6c8f40127e474e335af090b5f17a877c582e124825f8c8a00211fe74708cf3b32213a6c6dac0431529e5b64e
SSDEEP

6144:in4PGoKjj/Ddjj/ujj/ujj/myoSWjagfjj/:insGoKjj/Rjj/ujj/ujj/1oakjj/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	2916	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2916	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1792	2916	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe	28
PID 2916 wrote to memory of 1792	2916	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe	28
PID 2916 wrote to memory of 1792	2916	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe	28
PID 2916 wrote to memory of 1792	2916	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe	28

C:\Users\Admin\AppData\Local\Temp\4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe
"C:\Users\Admin\AppData\Local\Temp\4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 676
  2⤵
  - Program crash
  PID:1792

memory/2916-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2916-0-0x0000000000D70000-0x0000000000DDE000-memory.dmp

Filesize
440KB

Download
memory/2916-2-0x0000000004FB0000-0x0000000004FF0000-memory.dmp

Filesize
256KB

Download
memory/2916-3-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2916-4-0x0000000004FB0000-0x0000000004FF0000-memory.dmp

Filesize
256KB

Download