d380976324cb468fa7566ded335170dc48e4964aa0af9ee0383b659bff01ad3f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 01:33

Target

4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe
Size

1.2MB
MD5

1684aab6fae1ed888cf6d3c45e3f5fa7
SHA1

6acc87b81836575bf7b497f0e8a9a23a221f06b7
SHA256

4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab
SHA512

6d4bafe21686ce62cc129082e8dcd4da87fa7dcaea5eee9862a99adbb0142e89fe0e9d097ee2b9a9a6b6eab3ee23b6a26c4fa587d7ce1782a1d2e2c1454c2e71
SSDEEP

24576:2s/RUhtSWUeNXoCPxjyJVhGi4vGuOg9ajduJd/WDj0uX:2oRUhoK/9ecwjd6d/sIuX

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe

description pid process

Token: SeDebugPrivilege 2112 4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe

description	pid	process
Token: SeDebugPrivilege	2112	4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe

description	pid	process	target process
PID 2112 wrote to memory of 2376	2112	4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe	WerFault.exe
PID 2112 wrote to memory of 2376	2112	4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe	WerFault.exe
PID 2112 wrote to memory of 2376	2112	4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe
"C:\Users\Admin\AppData\Local\Temp\4114122c0dca23f637d83eed33f9abcdc92709e2ac6f63ffd55f5aae519b58ab.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 652
  2⤵
  PID:2376

memory/2112-0-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x0000000000930000-0x0000000000A6A000-memory.dmp

Filesize
1.2MB

Download
memory/2112-2-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-3-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2112-4-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download