cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 09:27

Target

Document Copy_pdf.exe
Size

884KB
MD5

f75f9606f6aeb72bf28ecd1419542d7d
SHA1

bc7eca6ece5ace34b990e8782dbe1782c33ea91b
SHA256

cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d
SHA512

25cf388cbf234948055f5096010615745b92a6aea28328910dde72a13fdfc7f0a580f2e6b9b0544875a985da83f41a2fe04c7dd36eb687095a768ef31c1dd64f
SSDEEP

24576:L0jj5VRQElW+B50gZuzTt/MDFdws7Sfn/eBGhW3:bElW+B53ZuPBaF2X7hW3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Document Copy_pdf.exe

description pid process

Token: SeDebugPrivilege 2140 Document Copy_pdf.exe

description	pid	process
Token: SeDebugPrivilege	2140	Document Copy_pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Document Copy_pdf.exe

description	pid	process	target process
PID 2140 wrote to memory of 860	2140	Document Copy_pdf.exe	WerFault.exe
PID 2140 wrote to memory of 860	2140	Document Copy_pdf.exe	WerFault.exe
PID 2140 wrote to memory of 860	2140	Document Copy_pdf.exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2140 -s 576
2⤵
PID:860

memory/2140-0-0x0000000000AA0000-0x0000000000AF0000-memory.dmp

Filesize
320KB

Download
memory/2140-1-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2140-2-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download
memory/2140-3-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/2140-4-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download