d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 01:57

Target

d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe
Size

816KB
MD5

44c6c88229153fb866a7948cfd25f9d1
SHA1

acf1f41c2e12d842082181ea7ec42d5158d38403
SHA256

d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c
SHA512

65bdf66f6c6db5f9505aab451255e9c669bb6d6e5b58e3fd7514c7078c388f285953efa41540c7ea73526d94b5f1ccd77cdea78280dba4d48e5adc63f80870a1
SSDEEP

24576:2prDAUwtdgdFfhq/VV1xPR1N9NOhP1yTs:CnwcdFExP3NOh8w

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe

description pid process

Token: SeDebugPrivilege 1964 d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe

description	pid	process
Token: SeDebugPrivilege	1964	d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe

description	pid	process	target process
PID 1964 wrote to memory of 2972	1964	d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe	WerFault.exe
PID 1964 wrote to memory of 2972	1964	d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe	WerFault.exe
PID 1964 wrote to memory of 2972	1964	d5d50b235ab55ea31684b88d27a02a23765217f3cd2da71cb9a8767ee9e4ed1c.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1964 -s 536
2⤵
PID:2972

memory/1964-0-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/1964-1-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/1964-2-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download