8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 01:43

Target

8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce.exe
Size

7KB
MD5

19c16c8666917e24e9f5a9b3786d26b6
SHA1

59c26cd4749bcf5927b2335cd56e49ab9548598f
SHA256

8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce
SHA512

3599fc4d1675b6d5e43a2fb8462d0ac59f49ed8c1e9cc81bd58a84f89767595c1ade5e2a008adab8c1bdc74f5db0f561fd68896262d129fe92b384fed01b0276
SSDEEP

96:WEoMQhJKs7EnCxs3VGNX3KHFCi4eiZWG+dJvw43R/YMwfYlwrzNt:WNTQIgh23KHWb+dJvdmMwf+wt

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2800	2640	8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce.exe	31
PID 2640 wrote to memory of 2800	2640	8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce.exe	31
PID 2640 wrote to memory of 2800	2640	8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce.exe	31

C:\Users\Admin\AppData\Local\Temp\8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce.exe
"C:\Users\Admin\AppData\Local\Temp\8083bf83f2cdde7e8f93fcf5adb526b06d3a1849d15e17c97621ec75a7ab8fce.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2640 -s 1060
  2⤵
  PID:2800

memory/2640-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2640-1-0x000000013FF10000-0x000000013FF16000-memory.dmp

Filesize
24KB

Download
memory/2640-2-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2640-3-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2640-4-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download