ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 01:40

Target

ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915.exe
Size

737KB
MD5

9b893026db16c997eae54b8fee950054
SHA1

3521840bebbd2d11905304e9f6e6f9fe4bbcde0c
SHA256

ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915
SHA512

590ea454d1d698ad8648a47d3527ba2ba8452ebd8ce64e68c08aa8b8caa4cff240f4fcf41bc3b98e47880f685556212dec3a394061c4c8f2c24b2aa6c3d68b88
SSDEEP

12288:DdSj4/u5JTJf78ZOZevK7ZgmeG7qhojOB2qpg6uo2pNq/63riXCDXLpLWfHr:DdSjS+5gI/imeeTAg6T2y/6uXC/pIr

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2256	2092	ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915.exe	29
PID 2092 wrote to memory of 2256	2092	ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915.exe	29
PID 2092 wrote to memory of 2256	2092	ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915.exe	29

C:\Users\Admin\AppData\Local\Temp\ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915.exe
"C:\Users\Admin\AppData\Local\Temp\ee1dbadcb7dad10737664a5026b39305bb58aee398d8f43018e52f7c99f78915.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 576
  2⤵
  PID:2256

memory/2092-0-0x0000000001040000-0x0000000001068000-memory.dmp

Filesize
160KB

Download
memory/2092-1-0x000007FEF5600000-0x000007FEF5FEC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-2-0x000000001B070000-0x000000001B0F0000-memory.dmp

Filesize
512KB

Download
memory/2092-3-0x000007FEF5600000-0x000007FEF5FEC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-4-0x000000001B070000-0x000000001B0F0000-memory.dmp

Filesize
512KB

Download