c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 14:57

Target

c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe
Size

545KB
MD5

881da0522cf92cdd44a9778bfd3d5569
SHA1

7b3d65ac8930b53d137a276f28b3e7100f7206a2
SHA256

c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763
SHA512

1a831ba9074e5562967f61cdee76e7cfd19ebe39d869e6d1d88cfab8335ca258118c695c0447856b7d31d3cff6c582dd00536273d841368e39cde0263b680727
SSDEEP

6144:2muIkxKEZsao1MggyosezYLKEbBOXkPElXxBnYcQMBKist1bGl3tYDG:TuIk03Vosn608lXxhK2Rt/

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2452	804	c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe	32
PID 804 wrote to memory of 2452	804	c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe	32
PID 804 wrote to memory of 2452	804	c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe	32

C:\Users\Admin\AppData\Local\Temp\c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe
"C:\Users\Admin\AppData\Local\Temp\c55880d6aebfcbf9c6a8328897447a337de10f597dd883e6f4838946ab591763.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 804 -s 1040
  2⤵
  PID:2452

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2940

memory/804-0-0x000007FEF5453000-0x000007FEF5454000-memory.dmp

Filesize
4KB

Download
memory/804-1-0x00000000012C0000-0x000000000134E000-memory.dmp

Filesize
568KB

Download
memory/804-2-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/804-3-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/804-4-0x000007FEF5453000-0x000007FEF5454000-memory.dmp

Filesize
4KB

Download
memory/804-5-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/804-7-0x0000000000450000-0x000000000045C000-memory.dmp

Filesize
48KB

Download