e12353f4d5f68aea92424cf34972738128fc010fe4fe3072d7098f9a299ed559

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 16:18

Target
Trust Launcher.exe
Size 4.5MB
Sample240710-tr7rnaxdmn
SHA256 e12353f4d5f68aea92424cf34972738128fc010fe4fe3072d7098f9a299ed559
MD5 6ee4d16a922c7c410c48a2d7dc55ece5
SHA1 4281072875fc6b223fe3be38f2164e873a68f031
SHA512 bcc1e2bd218cb745751d28472cdf87b60f8341579552fd973feff7e6dac62a69b2504dfa5e98bdef13f1cf9966b823c179e3ac456104d41ed1d937c44e714a9a
SSDEEP 24576:2gU6NieovQ2fTj8PDQCe5WXCjTZ18uv76/+3p8RIlRQVaU/DU/G24E10X9rjwFco:2KNiQEcGT710q6RIIwemixRD4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	3032	WerFault.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	Trust Launcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	Trust Launcher.exe
3032	Trust Launcher.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2792	3032	Trust Launcher.exe	30
PID 3032 wrote to memory of 2792	3032	Trust Launcher.exe	30
PID 3032 wrote to memory of 2792	3032	Trust Launcher.exe	30
PID 3032 wrote to memory of 2792	3032	Trust Launcher.exe	30
PID 3032 wrote to memory of 2792	3032	Trust Launcher.exe	30
PID 3032 wrote to memory of 2792	3032	Trust Launcher.exe	30
PID 3032 wrote to memory of 2792	3032	Trust Launcher.exe	30

C:\Users\Admin\AppData\Local\Temp\Trust Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Trust Launcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1336
  2⤵
  - Program crash
  PID:2792

memory/3032-0-0x000000007495E000-0x000000007495F000-memory.dmp

Download

memory/3032-1-0x00000000008F0000-0x0000000000D6A000-memory.dmp

Download

memory/3032-2-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/3032-3-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/3032-4-0x0000000074950000-0x000000007503E000-memory.dmp

Download