034a3732828ad09b79a12c66bf7eee3058427808bdae8b19291fffc828ee1fbf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 13:36

Target

SARL RABINEAU Order FA2495.exe
Size

609KB
MD5

4ac88ef7fe497d568f8c0256627f4f28
SHA1

ed66aadb1b165388e5a132f43874f385db546379
SHA256

034a3732828ad09b79a12c66bf7eee3058427808bdae8b19291fffc828ee1fbf
SHA512

b20a18998275e42a27aa56ff0318e2a119b00a5ffee04898e42c25524ee4abf1e68952c97236d4ecafdd143a9912d87f15e463ea3e62ac1bc028e9bbac54fbab
SSDEEP

12288:IxbVNv5uSru57PQFztYF2vLRHQ36D78MmeOZWczK3rlHxsKIy:IxRV5Lru57YF+iQe8MdM0JOy

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	SARL RABINEAU Order FA2495.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2512	2916	SARL RABINEAU Order FA2495.exe	29
PID 2916 wrote to memory of 2512	2916	SARL RABINEAU Order FA2495.exe	29
PID 2916 wrote to memory of 2512	2916	SARL RABINEAU Order FA2495.exe	29

C:\Users\Admin\AppData\Local\Temp\SARL RABINEAU Order FA2495.exe
"C:\Users\Admin\AppData\Local\Temp\SARL RABINEAU Order FA2495.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 540
  2⤵
  PID:2512

memory/2916-0-0x00000000008C0000-0x00000000008CA000-memory.dmp

Filesize
40KB

Download
memory/2916-1-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download
memory/2916-2-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

Filesize
9.9MB

Download