c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:15

Target

c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe
Size

3.6MB
MD5

1b2eb636916557667dccccf81a9987ba
SHA1

953834a7e13647588996b3f21aa9eb518b5fe732
SHA256

c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d
SHA512

3afe52234ca0d4ca8d53f627dcd265355274d554e930007b67139a984de9895d71cd5594aff4868ef46e8ea6bd7ee891aa3f5329c950d0775a96c502dcbabf44
SSDEEP

49152:eVQyVfvURPaN3Saa7gH56hSpmPOUK42VDER:eVQyVHURPaN3SaaUZ6hSAFK4yER

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe

pid	process
2928	c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe
2928	c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe

description pid process

Token: SeDebugPrivilege 2928 c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe

description	pid	process
Token: SeDebugPrivilege	2928	c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe

description	pid	process	target process
PID 2928 wrote to memory of 2136	2928	c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe	WerFault.exe
PID 2928 wrote to memory of 2136	2928	c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe	WerFault.exe
PID 2928 wrote to memory of 2136	2928	c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe
"C:\Users\Admin\AppData\Local\Temp\c94f00ed72ab44d708895db9d0121418dc92f865bd231c7fbc05c0fcce5f620d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2928 -s 696
  2⤵
  PID:2136

memory/2928-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x00000000003D0000-0x000000000076A000-memory.dmp

Filesize
3.6MB

Download
memory/2928-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download
memory/2928-3-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Filesize
4KB

Download
memory/2928-4-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Filesize
9.9MB

Download