7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

Resubmissions

25/08/2024, 17:50

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 17:50

Target

Bootstrapper.exe
Size

796KB
MD5

4b94b989b0fe7bec6311153b309dfe81
SHA1

bb50a4bb8a66f0105c5b74f32cd114c672010b22
SHA256

7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
SHA512

fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
SSDEEP

12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	Bootstrapper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 572	2548	Bootstrapper.exe	30
PID 2548 wrote to memory of 572	2548	Bootstrapper.exe	30
PID 2548 wrote to memory of 572	2548	Bootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2548 -s 968
  2⤵
  PID:572

memory/2548-0-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x0000000000150000-0x000000000021E000-memory.dmp

Filesize
824KB

Download
memory/2548-2-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download
memory/2548-3-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/2548-4-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download