6725da896273bada4c8384565b8d157f602357b386d8bceaf72b28899ed09fa8

Analysis

max time kernel
24s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 09:18

Target

b98463427ff48025b05cd711c1b2c830N.exe
Size

645KB
MD5

b98463427ff48025b05cd711c1b2c830
SHA1

861716752d1451a79da086cd8d4717786cc4f99e
SHA256

6725da896273bada4c8384565b8d157f602357b386d8bceaf72b28899ed09fa8
SHA512

8bf8b2334a050218fc18feaaab7c7ce181058a169038f244df7521a920ff26cf37d0b4b62f3d92abab79e5ce30a7256127f0806043424d18c3c54fe420430adc
SSDEEP

6144:z+IQqTIl5+RR19CUQ0uKfv6ZfKgpQ3xm:rkY1cUN36ZfKgC0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	2388	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	b98463427ff48025b05cd711c1b2c830N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2584	2388	b98463427ff48025b05cd711c1b2c830N.exe	29
PID 2388 wrote to memory of 2584	2388	b98463427ff48025b05cd711c1b2c830N.exe	29
PID 2388 wrote to memory of 2584	2388	b98463427ff48025b05cd711c1b2c830N.exe	29
PID 2388 wrote to memory of 2584	2388	b98463427ff48025b05cd711c1b2c830N.exe	29

C:\Users\Admin\AppData\Local\Temp\b98463427ff48025b05cd711c1b2c830N.exe
"C:\Users\Admin\AppData\Local\Temp\b98463427ff48025b05cd711c1b2c830N.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1668
  2⤵
  - Program crash
  PID:2584

memory/2388-0-0x0000000073B6E000-0x0000000073B6F000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000001230000-0x00000000012D6000-memory.dmp

Filesize
664KB

Download
memory/2388-2-0x0000000073B60000-0x000000007424E000-memory.dmp

Filesize
6.9MB

Download
memory/2388-3-0x0000000073B6E000-0x0000000073B6F000-memory.dmp

Filesize
4KB

Download
memory/2388-4-0x0000000073B60000-0x000000007424E000-memory.dmp

Filesize
6.9MB

Download