ecace832b0e30b5a54e6af43bd5a990ba0ffd4ecd549b6ca6597332f073579e3

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 22:27

Target

Loader.exe
Size

30.5MB
MD5

6f6d0e09fae7de66a3547c93dd3e7c97
SHA1

e42a226083e178e9d40bb0c52ece216ee7e48627
SHA256

a216b785458dfab3b50cb6203d486eeeb23938b34df97da29ac60a306c4668ae
SHA512

d2644ebe5bac6632e7e3ef6626b38af742be1e1cc56b163dd4edf3910857383949bc7e05f1b78037c1191c1f22d158e896a4b2b850bef8485f47fceeca89f7e1
SSDEEP

786432:8S9UdJ7EOnWdQb/0cVWXXS9UdJ7EOnWdQb/0cVW:8S9UH7EOWd6/fCS9UH7EOWd6/f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 1136 WerFault.exe Loader.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Loader.exe

description pid process

Token: SeDebugPrivilege 1136 Loader.exe

pid	pid_target	process	target process
1720	1136	WerFault.exe	Loader.exe

description	pid	process
Token: SeDebugPrivilege	1136	Loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Loader.exe

description	pid	process	target process
PID 1136 wrote to memory of 1720	1136	Loader.exe	WerFault.exe
PID 1136 wrote to memory of 1720	1136	Loader.exe	WerFault.exe
PID 1136 wrote to memory of 1720	1136	Loader.exe	WerFault.exe
PID 1136 wrote to memory of 1720	1136	Loader.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 1128
  2⤵
  - Program crash
  PID:1720

memory/1136-0-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/1136-1-0x0000000000840000-0x00000000026CE000-memory.dmp

Filesize
30.6MB

Download
memory/1136-2-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/1136-3-0x000000007470E000-0x000000007470F000-memory.dmp

Filesize
4KB

Download
memory/1136-4-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download