176065ce145a080d2c13128c05d3f6ee83de37ca4b61aa3b4188c2d53b4f2725

Analysis

max time kernel
12s
max time network
0s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 04:14

Target

VoicemodDesktop.exe
Size

5.3MB
MD5

2a3c1a98a7e076e69e72173754be7828
SHA1

cafd5d51d287fef1f7b8d3f75c6a91d573e0744f
SHA256

176065ce145a080d2c13128c05d3f6ee83de37ca4b61aa3b4188c2d53b4f2725
SHA512

fecc484293b5b13021f1d2b84e969c42c684a8e74b8f16d7017f8e9efd04935887f4b47f4acf153e62761a360fa6277db9433b25b4322173c258bfd841680e23
SSDEEP

49152:wQgAw1Zh83bXY7rDNIgQUue5zg2+GS7vCco09j5B3fBolyKmyiIgQUue5zg2:wRAPbUDWdUuesCevZjQylWdUues

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	VoicemodDesktop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2480	2892	VoicemodDesktop.exe	28
PID 2892 wrote to memory of 2480	2892	VoicemodDesktop.exe	28
PID 2892 wrote to memory of 2480	2892	VoicemodDesktop.exe	28

C:\Users\Admin\AppData\Local\Temp\VoicemodDesktop.exe
"C:\Users\Admin\AppData\Local\Temp\VoicemodDesktop.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2892 -s 628
  2⤵
  PID:2480

memory/2892-0-0x000007FEF5C43000-0x000007FEF5C44000-memory.dmp

Filesize
4KB

Download
memory/2892-1-0x0000000001080000-0x00000000015CE000-memory.dmp

Filesize
5.3MB

Download
memory/2892-2-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download
memory/2892-3-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download
memory/2892-4-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download