1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 12:04

Target

1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe
Size

829KB
MD5

664eddacb00d2d58f85cdc2913a1680e
SHA1

3dfce1917291ff78513dba84e8ac715700d814d7
SHA256

1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee
SHA512

a7c3be40568a5b531b648497be3a4e1abe7408e75a2981575b4858a945c66958af0eb01c4abc4c135f83c120e6f50d6cf148dca1b79b82dc2c9b7185406d4893
SSDEEP

12288:Ejwz+S8matk6SosnQq8xMdzq/0P5uxvSpN1HVuX+1Bhkc92Wkdu7n1Gwi:8wCSwk6SotJguxvCN1HVuO1rjFkG18

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2332	1924	1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe	29
PID 1924 wrote to memory of 2332	1924	1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe	29
PID 1924 wrote to memory of 2332	1924	1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe	29

C:\Users\Admin\AppData\Local\Temp\1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe
"C:\Users\Admin\AppData\Local\Temp\1bb742c209872385c5b456d066fccf141ab2405245953c135b36029a3dbd5bee.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 572
  2⤵
  PID:2332

memory/1924-0-0x000007FEF5953000-0x000007FEF5954000-memory.dmp

Filesize
4KB

Download
memory/1924-1-0x0000000000800000-0x000000000083C000-memory.dmp

Filesize
240KB

Download
memory/1924-2-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download
memory/1924-3-0x000007FEF5953000-0x000007FEF5954000-memory.dmp

Filesize
4KB

Download
memory/1924-4-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

Filesize
9.9MB

Download