69811fd3a031d56a72428c7f3f74573b551c2dc9b5fb827fe6740a03eae55f31

Resubmissions

01-06-2024 17:26

01-06-2024 17:08

01-06-2024 16:56

01-06-2024 16:43

01-06-2024 15:54

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 16:56

Target

New Text Document.exe
Size

4KB
MD5

a239a27c2169af388d4f5be6b52f272c
SHA1

0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c
SHA256

98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc
SHA512

f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da
SSDEEP

48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	New Text Document.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2556	2904	New Text Document.exe	29
PID 2904 wrote to memory of 2556	2904	New Text Document.exe	29
PID 2904 wrote to memory of 2556	2904	New Text Document.exe	29

C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2904 -s 1072
  2⤵
  PID:2556

memory/2904-0-0x000007FEF5663000-0x000007FEF5664000-memory.dmp

Filesize
4KB

Download
memory/2904-1-0x0000000000D30000-0x0000000000D38000-memory.dmp

Filesize
32KB

Download
memory/2904-2-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download
memory/2904-3-0x000007FEF5663000-0x000007FEF5664000-memory.dmp

Filesize
4KB

Download
memory/2904-4-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download