7391718fd0958533d3857effb96cbebd00ceb5ed5bf3b11eb8e049db36e7315f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 09:56

Target

BlammedOwned.exe
Size

2.0MB
MD5

04abf74d7f4e959c28f6cee61a95fe41
SHA1

e2cb85b4a0e7c56387eaaa778d03cb8fa6ae4c13
SHA256

7391718fd0958533d3857effb96cbebd00ceb5ed5bf3b11eb8e049db36e7315f
SHA512

676b1c55b46fec34f91dd03af9dcf46023ca85c8e3eb77a9cfc81cbdc613618aca5914774a57f2b1a876a07668cb952a57eae75d43aebb3d5a429aa173c4ff56
SSDEEP

49152:DvmbpxEjwwo96s68x924MTEceBaYItakmEKC464q0GtKJ:JTo9T/9OIP5kmEKC464rGk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	1548	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1548	BlammedOwned.exe
1548	BlammedOwned.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	BlammedOwned.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1864	1548	BlammedOwned.exe	28
PID 1548 wrote to memory of 1864	1548	BlammedOwned.exe	28
PID 1548 wrote to memory of 1864	1548	BlammedOwned.exe	28
PID 1548 wrote to memory of 1864	1548	BlammedOwned.exe	28

C:\Users\Admin\AppData\Local\Temp\BlammedOwned.exe
"C:\Users\Admin\AppData\Local\Temp\BlammedOwned.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 664
  2⤵
  - Program crash
  PID:1864

memory/1548-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/1548-1-0x0000000000A20000-0x0000000000C22000-memory.dmp

Filesize
2.0MB

Download
memory/1548-2-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-3-0x0000000004960000-0x0000000004A5E000-memory.dmp

Filesize
1016KB

Download
memory/1548-4-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download