cbda8606094d0493370b0f219edaba9be92444967aa9259d3e9323314dca2daa

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 08:06

Target

Quotation Order.exe
Size

891KB
MD5

d797aae1eaf481e9c887482192b84109
SHA1

acf58b4eb3f0ffda9a2cd91def583422a11ed873
SHA256

cbda8606094d0493370b0f219edaba9be92444967aa9259d3e9323314dca2daa
SHA512

605151432227a27e70c7884a7300e2cda5450970a5bb67cb6139fb69ee1facbe2dc95799905080456db0549aa04e35870e4142aafbcb60aa175f9526f3f7753c
SSDEEP

24576:4wzm9u/h4/YiCLuiq3crVdkwGdYCxUw/ATA:pmuhWYiCaivGWPwITA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Quotation Order.exe

description pid process

Token: SeDebugPrivilege 1800 Quotation Order.exe

description	pid	process
Token: SeDebugPrivilege	1800	Quotation Order.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Quotation Order.exe

description	pid	process	target process
PID 1800 wrote to memory of 636	1800	Quotation Order.exe	WerFault.exe
PID 1800 wrote to memory of 636	1800	Quotation Order.exe	WerFault.exe
PID 1800 wrote to memory of 636	1800	Quotation Order.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1800 -s 576
2⤵
PID:636

memory/1800-0-0x0000000000CE0000-0x0000000000D30000-memory.dmp

Filesize
320KB

Download
memory/1800-1-0x000007FEF5770000-0x000007FEF615C000-memory.dmp

Filesize
9.9MB

Download
memory/1800-2-0x00000000003D0000-0x0000000000450000-memory.dmp

Filesize
512KB

Download
memory/1800-3-0x000007FEF5770000-0x000007FEF615C000-memory.dmp

Filesize
9.9MB

Download
memory/1800-4-0x00000000003D0000-0x0000000000450000-memory.dmp

Filesize
512KB

Download