0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 01:11

Target

0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe
Size

925KB
MD5

3eff7e12316bada32f0397027fea475b
SHA1

f030aecbbb82ca2675eb56a5a9366c1fc318484c
SHA256

0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8
SHA512

2c37005867865d31485207ff0db780f6697d667653d2620ce084e804003d3913f8745765507413723a68932f169fe81eacb3ccca11a258c9fbe45858469727c4
SSDEEP

24576:FhmUTTAKL8oedI3uOMznyBduen8FBIVAIbXngw:lTTAvoeeuunIBIVBb1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe

description pid process

Token: SeDebugPrivilege 2752 0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe

description	pid	process
Token: SeDebugPrivilege	2752	0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe

description	pid	process	target process
PID 2752 wrote to memory of 2620	2752	0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe	WerFault.exe
PID 2752 wrote to memory of 2620	2752	0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe	WerFault.exe
PID 2752 wrote to memory of 2620	2752	0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe
"C:\Users\Admin\AppData\Local\Temp\0ca51e00d217167847c3fceeeea13a2f1f009e055d694f8f208d2af1176581c8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2752 -s 576
  2⤵
  PID:2620

memory/2752-0-0x0000000000CE0000-0x0000000000D3A000-memory.dmp

Filesize
360KB

Download
memory/2752-1-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2752-2-0x0000000000C30000-0x0000000000CB0000-memory.dmp

Filesize
512KB

Download
memory/2752-3-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2752-4-0x0000000000C30000-0x0000000000CB0000-memory.dmp

Filesize
512KB

Download