a5ac5758c9bf51d0d9d90e750e71300e8def7ecc099ca2c3f1ce7a26dfeebdf2

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 23:48

Target

SLURP 3.1 - 17.05.2019/UpdateSlurp.exe
Size

521KB
MD5

7b1f428b7bf64557765bfc762f39c12a
SHA1

ee6b936eff0cd08f01265f78a371fea490689e91
SHA256

c4e30d136a51ad4b4834b58ebbe586afe0e819da7d19a987e77678ac89f1d01f
SHA512

472da6f9326e1caa287a8db5962ba3ba6f6ecc2a5c2cfeb7964b32fd641b47ff5861e852c894256ee22a65b63f1d1cd41e035194ca38bcc4f648c8f49560d512
SSDEEP

3072:hUA6O9cDrAN4EZkbbsd+onx9ZAiPYDalmpUEiyhsa2:/N4OkenTCWeiiT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	1740	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	UpdateSlurp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2116	1740	UpdateSlurp.exe	29
PID 1740 wrote to memory of 2116	1740	UpdateSlurp.exe	29
PID 1740 wrote to memory of 2116	1740	UpdateSlurp.exe	29
PID 1740 wrote to memory of 2116	1740	UpdateSlurp.exe	29

C:\Users\Admin\AppData\Local\Temp\SLURP 3.1 - 17.05.2019\UpdateSlurp.exe
"C:\Users\Admin\AppData\Local\Temp\SLURP 3.1 - 17.05.2019\UpdateSlurp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1152
  2⤵
  - Program crash
  PID:2116

memory/1740-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x00000000002A0000-0x000000000032C000-memory.dmp

Filesize
560KB

Download
memory/1740-2-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/1740-3-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1740-4-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/1740-5-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download