3da6e78e2de91d5f9ff41af0eb84e6be790438a519d2bd5da50ff7bdcb38d8ca

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 03:52

Target
l3oo/SC 1.4.6/Updater.exe
Size 5KB
Sample240603-ee8e4abf92
SHA256 5778e21d26b03fa45e77bdb3de448dd0121852a335df451681d164e3ecbda3c1
MD5 2405418539258e33534b687a1b773d5d
SHA1 5fb8e138d1686fd121b6020510c055667115c3ab
SHA512 ed7b13cc96afa59efe1c3791f05ad52876030a9d6fa15a50285b61e50184a0d66ddfeed88e4bfb875e04618e540d96cb5196d5a4d34e453b77f4d8e77081231e
SSDEEP 48:673VTRxOsWOrixhaOkG8bNMe+NQb9XO+zkYx0LmZsFtR7l+oIfFipfbNtm:ETxOoEhaj+N+zkYGLwozzNt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	2888	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	Updater.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3024	2888	Updater.exe	29
PID 2888 wrote to memory of 3024	2888	Updater.exe	29
PID 2888 wrote to memory of 3024	2888	Updater.exe	29
PID 2888 wrote to memory of 3024	2888	Updater.exe	29

C:\Users\Admin\AppData\Local\Temp\l3oo\SC 1.4.6\Updater.exe
"C:\Users\Admin\AppData\Local\Temp\l3oo\SC 1.4.6\Updater.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 1012
  2⤵
  - Program crash
  PID:3024

memory/2888-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Download

memory/2888-1-0x0000000001260000-0x0000000001268000-memory.dmp

Download

memory/2888-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Download

memory/2888-3-0x0000000074B20000-0x000000007520E000-memory.dmp

Download