a5f17947f82d1416344a0a36f7656fb2ad7821237d123174e9ec7949ba4368e4

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 01:20

Target

Order Sample Requirement.exe
Size

797KB
MD5

f810eab09003409284cb1db8f0dc2c4b
SHA1

780344e6415405a41d1e5017378d0c3d19386e92
SHA256

7fc2d1f521d7f24e30e4baa04c9e6796520ea63f153e7942e04ac71deaf01f6b
SHA512

cfc4e0692b159287e98245686c6c7d77e31b36fbbbed42eb738cdf71be805b2269b4c472272a02946bd483df8efe4ddb191b9945b74aaa6452d60121533f3ea0
SSDEEP

24576:FklEyBGrRO886HkAT2OpZEPzLogQUjGVL7rklsZ0:xcGrRO8jHk5OpZErLogQ+GVL7Yl00

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Order Sample Requirement.exe

description pid process

Token: SeDebugPrivilege 2168 Order Sample Requirement.exe

description	pid	process
Token: SeDebugPrivilege	2168	Order Sample Requirement.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Order Sample Requirement.exe

description	pid	process	target process
PID 2168 wrote to memory of 2080	2168	Order Sample Requirement.exe	WerFault.exe
PID 2168 wrote to memory of 2080	2168	Order Sample Requirement.exe	WerFault.exe
PID 2168 wrote to memory of 2080	2168	Order Sample Requirement.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order Sample Requirement.exe
"C:\Users\Admin\AppData\Local\Temp\Order Sample Requirement.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2168 -s 572
  2⤵
  PID:2080

memory/2168-0-0x00000000002A0000-0x00000000002DA000-memory.dmp

Filesize
232KB

Download
memory/2168-1-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/2168-2-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/2168-3-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/2168-4-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download