92e558e20710b94f8509b9ee29fdf2bc485c369edc93b46fbb10fa40b3727b9c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 01:48

Target

d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45.exe
Size

381KB
MD5

cb1fa9b5d0509372c8299742a9a36228
SHA1

bb8e5a0206f8909afbf5b32a1493e686e596c040
SHA256

d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45
SHA512

61c74cab5d8928b9cfb53ddc8ba4b0528ba6cddf72b8ae7a866a5c77f27079d3cc2752ab0d533635701c94e2de49c92d600a1d74f734268d535cb53750696826
SSDEEP

6144:nuDVaPk2lPJXTFeDesiljumKYkgJTZHuNp1j2kgotz298P/uH8hzJr9dPYM25PEB:uDVaPkaPJXheUumKYkgJZWp1j2szh+8H

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2368	3024	d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45.exe	29
PID 3024 wrote to memory of 2368	3024	d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45.exe	29
PID 3024 wrote to memory of 2368	3024	d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45.exe	29

C:\Users\Admin\AppData\Local\Temp\d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45.exe
"C:\Users\Admin\AppData\Local\Temp\d09f47363c21f002a615eb6476973cf907eb9c4ab16b1f9aa3909e200665ac45.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 584
  2⤵
  PID:2368

memory/3024-0-0x0000000000DE0000-0x0000000000DEA000-memory.dmp

Filesize
40KB

Download
memory/3024-1-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-2-0x000000001B080000-0x000000001B100000-memory.dmp

Filesize
512KB

Download
memory/3024-3-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/3024-4-0x000000001B080000-0x000000001B100000-memory.dmp

Filesize
512KB

Download