3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279

Analysis

max time kernel
16s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 01:15

Target

3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279.exe
Size

359KB
MD5

88e5d9d97d0e3c83e74926986d6e5ef6
SHA1

37c8bcfde800dea135577b3254b11c6fe639dc21
SHA256

3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279
SHA512

e4756404059c4daf2e287baa18b81564f5d616fe13e646109a40d7c3a66c11016174dd39a0639d7656e3beb8c4e9de4ab1cde77c470bed873bdd09b979943ece
SSDEEP

6144:+3AtVSBNhoeDUrsi+VmwnJ5D/ArmtPk8Rs9LzIPZ3CpUiS:+QL8LoTrsLFnJ5DY8by5zE3Cy

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1016	2544	3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279.exe	29
PID 2544 wrote to memory of 1016	2544	3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279.exe	29
PID 2544 wrote to memory of 1016	2544	3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279.exe	29

C:\Users\Admin\AppData\Local\Temp\3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279.exe
"C:\Users\Admin\AppData\Local\Temp\3fb119b04cae83ea2ba10d7cbbcdffce895b07d6abd06a921626221aa3e0d279.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2544 -s 596
  2⤵
  PID:1016

memory/2544-0-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x0000000000320000-0x000000000037E000-memory.dmp

Filesize
376KB

Download
memory/2544-2-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-3-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-4-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/2544-5-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download