0d23cb796416bcf04260bdf9d1eef9300de08fff1da13a181c57d065d98bdfae

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 09:27

Target

24042024_ithalat_dekont.exe
Size

604KB
MD5

7ddd5227ec23c776e1ad950e60eb37ca
SHA1

7e0c332beb86a7d011e13ede52a77cbfa25740c0
SHA256

0d23cb796416bcf04260bdf9d1eef9300de08fff1da13a181c57d065d98bdfae
SHA512

08c0d3db1462cbf9961bd0f7ba2dda8eba5f907d742e04453c7f87de17c4b036255d6af66028b1726073db55a068cc7f1eb51e59ff8dbf9c4cd3c1329fb0cba3
SSDEEP

12288:7Simbs5M7iO9sV5+JrfeWJm86J6gBh7ta8oZQPid2j9f:7VmbYMr9sYrWB86J6gfM8oZQc2jR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

24042024_ithalat_dekont.exe

description pid process

Token: SeDebugPrivilege 2156 24042024_ithalat_dekont.exe

description	pid	process
Token: SeDebugPrivilege	2156	24042024_ithalat_dekont.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

24042024_ithalat_dekont.exe

description	pid	process	target process
PID 2156 wrote to memory of 2468	2156	24042024_ithalat_dekont.exe	WerFault.exe
PID 2156 wrote to memory of 2468	2156	24042024_ithalat_dekont.exe	WerFault.exe
PID 2156 wrote to memory of 2468	2156	24042024_ithalat_dekont.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2156 -s 540
2⤵
PID:2468

memory/2156-0-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/2156-1-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download
memory/2156-2-0x000007FEF5840000-0x000007FEF622C000-memory.dmp

Filesize
9.9MB

Download