169605839aebe681cc8f32304083932a0a710dad4d24c900a9dc17d92f6efd29

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 01:15

Target

FSE2.exe
Size

50KB
MD5

3edc1fc459ea2dc098722261ec3fbe05
SHA1

8fbb8efa0a3ba27d29a184a4b182ff537f82c9a8
SHA256

89f3cdd4c1e20eeac4d39fa709d40e8f3ebd8985a0a76673a44cf117eeeb458b
SHA512

a6cf1c104f8dece689cd21f7d65d510f07e86d25600f42d61838a664fbf640ead66fe4523499a38f37951faa3028bd469ad8f483287f986218f8cbfb50f3256d
SSDEEP

768:PhiPG/q1nVY2kh5yGJMwCH8Ufrg04g0rTpEIkGAwd:pzonVXkhVJMwCH5frgiMd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2736 3032 WerFault.exe FSE2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FSE2.exe

description pid process

Token: SeDebugPrivilege 3032 FSE2.exe

pid	pid_target	process	target process
2736	3032	WerFault.exe	FSE2.exe

description	pid	process
Token: SeDebugPrivilege	3032	FSE2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

FSE2.exe

description	pid	process	target process
PID 3032 wrote to memory of 2736	3032	FSE2.exe	WerFault.exe
PID 3032 wrote to memory of 2736	3032	FSE2.exe	WerFault.exe
PID 3032 wrote to memory of 2736	3032	FSE2.exe	WerFault.exe
PID 3032 wrote to memory of 2736	3032	FSE2.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1268
2⤵
- Program crash
PID:2736

memory/3032-0-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000000D70000-0x0000000000D82000-memory.dmp

Filesize
72KB

Download
memory/3032-2-0x0000000004B20000-0x0000000004C96000-memory.dmp

Filesize
1.5MB

Download
memory/3032-3-0x0000000000210000-0x000000000021C000-memory.dmp

Filesize
48KB

Download
memory/3032-4-0x00000000002A0000-0x00000000002B0000-memory.dmp

Filesize
64KB

Download
memory/3032-5-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/3032-6-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/3032-7-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download