6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 01:24

Target

6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe
Size

888KB
MD5

7c5508484d8b61155b13bb8476fb5f70
SHA1

ab2be33782022e9f04dcbe25633d5c362193ecf3
SHA256

6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323
SHA512

7245fe40ba2ae2f81ac956b71b9962eee64382e3171da3f4d55a9748ee992ee3c861d02712d5aa0f04155146879a58d6bee966dd5e638d413593b26d2ecf9643
SSDEEP

24576:2wGf9bYNj0WU66TcnohHWJxpyz+epkQ4/Kh9YX3:A6OWU6dUoxpy14/KUH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2348	2388	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	29
PID 2388 wrote to memory of 2348	2388	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	29
PID 2388 wrote to memory of 2348	2388	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	29

C:\Users\Admin\AppData\Local\Temp\6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe
"C:\Users\Admin\AppData\Local\Temp\6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2388 -s 576
  2⤵
  PID:2348

memory/2388-0-0x0000000000E40000-0x0000000000E90000-memory.dmp

Filesize
320KB

Download
memory/2388-1-0x000007FEF5AC0000-0x000007FEF64AC000-memory.dmp

Filesize
9.9MB

Download
memory/2388-2-0x000000001B250000-0x000000001B2D0000-memory.dmp

Filesize
512KB

Download
memory/2388-3-0x000007FEF5AC0000-0x000007FEF64AC000-memory.dmp

Filesize
9.9MB

Download
memory/2388-4-0x000000001B250000-0x000000001B2D0000-memory.dmp

Filesize
512KB

Download