95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 09:53

Target

15ce9e885610d5b85500ea0d139f6d21.exe
Size

404KB
MD5

15ce9e885610d5b85500ea0d139f6d21
SHA1

99f1392185a70453f33e15d6f5b75064217c2c18
SHA256

95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e
SHA512

9ee8e3fb682cf7abb5804106f841551f2f0fd8ace9842e67f3bda573772d39a6482d19e853de5a9a48d177350a3398cb814105ced01fdfb1be6db7e8bc9055b9
SSDEEP

6144:/IJTLRoSz47P8DiLdwXQIPcnEPjj9tQPBBpRPZi9opzUeqcnoKPcmPuJkJ:wlRoSz4j8DM6gIxfUP+2Ye9oCcmf

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

15ce9e885610d5b85500ea0d139f6d21.exe

description pid process

Token: SeDebugPrivilege 1412 15ce9e885610d5b85500ea0d139f6d21.exe

description	pid	process
Token: SeDebugPrivilege	1412	15ce9e885610d5b85500ea0d139f6d21.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

15ce9e885610d5b85500ea0d139f6d21.exe

description	pid	process	target process
PID 1412 wrote to memory of 2188	1412	15ce9e885610d5b85500ea0d139f6d21.exe	WerFault.exe
PID 1412 wrote to memory of 2188	1412	15ce9e885610d5b85500ea0d139f6d21.exe	WerFault.exe
PID 1412 wrote to memory of 2188	1412	15ce9e885610d5b85500ea0d139f6d21.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\15ce9e885610d5b85500ea0d139f6d21.exe
"C:\Users\Admin\AppData\Local\Temp\15ce9e885610d5b85500ea0d139f6d21.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1412 -s 572
  2⤵
  PID:2188

memory/1412-0-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/1412-1-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

Filesize
9.9MB

Download
memory/1412-2-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/1412-3-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

Filesize
9.9MB

Download
memory/1412-4-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download