0217aa1aa81a6e492b9b210fc349e8e71b1e0f4ac75289a271bd75111018924a

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 18:27

Target

ULTIMATE KASU/DWMLUT (COLORS)/LUT GUI (windows 10 only)/DwmLutGUI.exe
Size

41KB
MD5

3b4757e1a391ad8afe84a433ea044335
SHA1

1d04873b685e26377ed7be16f1dea43f149dd07e
SHA256

5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280
SHA512

a4f95040ebb2839b6f87dacd687e22110e6f02c5a7032f4d9645c20b4bfe58cd8fb39eec9e1c59f4cb7fb6e6a23aa89e06d16713fa5fed337f0b192353574a3a
SSDEEP

768:Xu3QbzTyrqZmr3dYzBA9dMFciV5yQIXXFABQJVDDDDDRVDDDDDsetYcFwVc6K:XaQXurqZmr3dEKjit5yQIXVABQ0iwVcl

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	DwmLutGUI.exe
Token: SeDebugPrivilege	2568	DwmLutGUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 952	2568	DwmLutGUI.exe	31
PID 2568 wrote to memory of 952	2568	DwmLutGUI.exe	31
PID 2568 wrote to memory of 952	2568	DwmLutGUI.exe	31

C:\Users\Admin\AppData\Local\Temp\ULTIMATE KASU\DWMLUT (COLORS)\LUT GUI (windows 10 only)\DwmLutGUI.exe
"C:\Users\Admin\AppData\Local\Temp\ULTIMATE KASU\DWMLUT (COLORS)\LUT GUI (windows 10 only)\DwmLutGUI.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2568 -s 688
  2⤵
  PID:952

memory/2568-0-0x000007FEF5F53000-0x000007FEF5F54000-memory.dmp

Filesize
4KB

Download
memory/2568-1-0x000000013F160000-0x000000013F16E000-memory.dmp

Filesize
56KB

Download
memory/2568-2-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp

Filesize
9.9MB

Download
memory/2568-3-0x0000000000660000-0x0000000000676000-memory.dmp

Filesize
88KB

Download
memory/2568-4-0x000007FEF5F53000-0x000007FEF5F54000-memory.dmp

Filesize
4KB

Download
memory/2568-5-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp

Filesize
9.9MB

Download