9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 02:38

Target

9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe
Size

1.1MB
MD5

0be4ea79598798ba9c585c7c0106e5b2
SHA1

1a0fa3f87ad498e45c52eb3af5c003ea4e2135ac
SHA256

9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6
SHA512

78fb00f46ab805d1671ebb6b7c378523742608a36fcde709f722f4222c60acb1c454fdd750d84edd5a5ed94883a3456a69e2bb4ea057757543688900e969e357
SSDEEP

24576:zuxkXWtPcZztujn7z3LG5KuRgPKvbJ7QDS9+uom:ekXWNcRtuz7GI3yvV79d

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1844	9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2540	1844	9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe	28
PID 1844 wrote to memory of 2540	1844	9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe	28
PID 1844 wrote to memory of 2540	1844	9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe	28

C:\Users\Admin\AppData\Local\Temp\9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe
"C:\Users\Admin\AppData\Local\Temp\9422c69c6e16fd72aa9c62328ea4777a4ebc1e786882c3fc283c21d449a6f8b6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1844 -s 852
  2⤵
  PID:2540

memory/1844-0-0x0000000000150000-0x0000000000182000-memory.dmp

Filesize
200KB

Download
memory/1844-1-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download
memory/1844-3-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/1844-2-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/1844-4-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/1844-8-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/1844-9-0x000007FEF5B30000-0x000007FEF651C000-memory.dmp

Filesize
9.9MB

Download