8be410717226b5e873c61a30d92a767c6c6492ce6358cd79b2a41cb23dba05cd

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 09:31

Target

PersonMgrV108A/PersonMgr.exe
Size

176KB
MD5

43a1922f49ebc97ad4ba44f52465845a
SHA1

41600e6acb37342d0516ba31baade3afeff82d17
SHA256

1b694e0c48c8f6a9c57266ea623f8c4a4169350512294cd0f7345ecf72ea8308
SHA512

aacdc8e0edf420f1ad2e2ae1dadd4c85d62a759293a9cf0b36424d4f8d646584c417a9d3685be16c7f5872b629d9bb7666b74a6121eb28eaa5aa07da340d9892
SSDEEP

3072:VCBJu8Mg/szgDywubOg6mF3AFryNubdaoGuxIG8wMiMkJWk4oyOu:KJ/aP7Z3eKubduuxIvMHy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2024	WerFault.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2024	PersonMgr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	PersonMgr.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2024	PersonMgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2024	PersonMgr.exe
2024	PersonMgr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2656	2024	PersonMgr.exe	30
PID 2024 wrote to memory of 2656	2024	PersonMgr.exe	30
PID 2024 wrote to memory of 2656	2024	PersonMgr.exe	30
PID 2024 wrote to memory of 2656	2024	PersonMgr.exe	30

C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\PersonMgr.exe
"C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\PersonMgr.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 364
  2⤵
  - Program crash
  PID:2656