2426ae0a0e63fa1102ab84b0fa0ccb98c15546c6778512608c8e0ce06c73b71a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 01:20

Target

02361cd60f5298950adc950dff1a91b4.exe
Size

498KB
MD5

02361cd60f5298950adc950dff1a91b4
SHA1

dc56996cea0a4599f376111267f3b688f1e30362
SHA256

2426ae0a0e63fa1102ab84b0fa0ccb98c15546c6778512608c8e0ce06c73b71a
SHA512

563ec30e190ad988402128583cb2d642e0440e89eb286d44e62fb2a93d77a2c3430900515ff0fd0c2d007cc510dd10d3e933bbd7cc8141823abe39e58c62d88e
SSDEEP

12288:V+XGr3PS5oHUeJjF1dBzk27QRQ62e2p2iR9sadpHr1+XLiZ9g:l/HUUb7AQPRiCp

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	02361cd60f5298950adc950dff1a91b4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2584	2804	02361cd60f5298950adc950dff1a91b4.exe	28
PID 2804 wrote to memory of 2584	2804	02361cd60f5298950adc950dff1a91b4.exe	28
PID 2804 wrote to memory of 2584	2804	02361cd60f5298950adc950dff1a91b4.exe	28

C:\Users\Admin\AppData\Local\Temp\02361cd60f5298950adc950dff1a91b4.exe
"C:\Users\Admin\AppData\Local\Temp\02361cd60f5298950adc950dff1a91b4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2804 -s 760
  2⤵
  PID:2584

memory/2804-0-0x000007FEF5C63000-0x000007FEF5C64000-memory.dmp

Filesize
4KB

Download
memory/2804-1-0x00000000000A0000-0x0000000000126000-memory.dmp

Filesize
536KB

Download
memory/2804-2-0x0000000001EF0000-0x0000000001F5E000-memory.dmp

Filesize
440KB

Download
memory/2804-3-0x000007FEF5C63000-0x000007FEF5C64000-memory.dmp

Filesize
4KB

Download