69d2fc18cf16863e10a2d87d85117a78bb2e2f4e630558812e738690dd244084

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 08:40

Target

13a4ea8f9354f5a82741c904961eb9e0N.exe
Size

10KB
MD5

13a4ea8f9354f5a82741c904961eb9e0
SHA1

54cb489c954dedd44843b910f251a003931d1976
SHA256

69d2fc18cf16863e10a2d87d85117a78bb2e2f4e630558812e738690dd244084
SHA512

9970481fe80a65f8622c0feb96716925ccc4506bd20314d233e4e47306ad8fc2d22faab1aa115e25a340c7eaa1e889947959198c7379ba2c5f1a9406d8a14240
SSDEEP

96:uRfx/g94/sMyxCSuI2dfnbK/y79dCieQ8LvOv03vFuaut+g0UIqQNx9EkrC7Agjs:QfxUhDxmIu/Ws9dXeZKtcgdIn79tmfy

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	13a4ea8f9354f5a82741c904961eb9e0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2920	2276	13a4ea8f9354f5a82741c904961eb9e0N.exe	30
PID 2276 wrote to memory of 2920	2276	13a4ea8f9354f5a82741c904961eb9e0N.exe	30
PID 2276 wrote to memory of 2920	2276	13a4ea8f9354f5a82741c904961eb9e0N.exe	30

C:\Users\Admin\AppData\Local\Temp\13a4ea8f9354f5a82741c904961eb9e0N.exe
"C:\Users\Admin\AppData\Local\Temp\13a4ea8f9354f5a82741c904961eb9e0N.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2276 -s 1068
  2⤵
  PID:2920

memory/2276-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000000AD0000-0x0000000000AD8000-memory.dmp

Filesize
32KB

Download
memory/2276-2-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/2276-3-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download
memory/2276-4-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download