b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 02:56

Target

b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe
Size

46.1MB
MD5

e7cd705760309001e9cdfd9d33aabfa9
SHA1

f14bb1f004c425e9b7a89552386c5cb1d6b02ae9
SHA256

b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef
SHA512

e25bd745e138082b2288899649d57702a1cd26b75a71a20fd778021e7c27ee9b152f63039aaab80190deceed2b94667ad54056935e27e7dc8f13910b2dbffb47
SSDEEP

786432:Wwb93z3Cjdndlc2dynl5yoC/jhFz3CjdJ:WGgdK24yoC/j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	2028	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1264	2028	b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe	28
PID 2028 wrote to memory of 1264	2028	b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe	28
PID 2028 wrote to memory of 1264	2028	b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe	28
PID 2028 wrote to memory of 1264	2028	b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe	28

C:\Users\Admin\AppData\Local\Temp\b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe
"C:\Users\Admin\AppData\Local\Temp\b561d67c2982629b2cd215076fbb65abd5a5850f13088c0fbea7a6d2115b5fef.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 620
  2⤵
  - Program crash
  PID:1264

memory/2028-0-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-1-0x0000000000D50000-0x0000000003B7A000-memory.dmp

Filesize
46.2MB

Download
memory/2028-2-0x0000000007620000-0x0000000007660000-memory.dmp

Filesize
256KB

Download
memory/2028-3-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2028-4-0x0000000007620000-0x0000000007660000-memory.dmp

Filesize
256KB

Download