97572bd57b08b59744e4dfe6f93fb96be4002dfe1aa78683771725401776464f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 10:53

Target

BootstrapperV1.19.exe
Size

972KB
MD5

90fd25ced85fe6db28d21ae7d1f02e2c
SHA1

e27eff4cd4d383f5c564cce2bd1aaa2ffe4ec056
SHA256

97572bd57b08b59744e4dfe6f93fb96be4002dfe1aa78683771725401776464f
SHA512

1c775cf8dfde037eaa98eb14088c70d74923f0f6a83030a71f2f4c1a4453f6154dab7a4aa175e429860badda3e5e0ae226f3c3e8171332f5962bf36f8aa073fa
SSDEEP

24576:DIbp4sZotkNjFC/4qxp+k+kPFoHZvPrSMc:cvotkNjg/lhqZvG

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	BootstrapperV1.19.exe
Token: SeDebugPrivilege	2728	BootstrapperV1.19.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2040	2524	BootstrapperV1.19.exe	32
PID 2524 wrote to memory of 2040	2524	BootstrapperV1.19.exe	32
PID 2524 wrote to memory of 2040	2524	BootstrapperV1.19.exe	32
PID 2728 wrote to memory of 2684	2728	BootstrapperV1.19.exe	35
PID 2728 wrote to memory of 2684	2728	BootstrapperV1.19.exe	35
PID 2728 wrote to memory of 2684	2728	BootstrapperV1.19.exe	35

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.19.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.19.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2524 -s 1076
  2⤵
  PID:2040

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.19.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.19.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2728 -s 1076
  2⤵
  PID:2684

memory/2524-0-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2524-1-0x0000000000300000-0x00000000003FA000-memory.dmp

Filesize
1000KB

Download
memory/2524-2-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-3-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2524-4-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download
memory/2728-5-0x000007FEF5663000-0x000007FEF5664000-memory.dmp

Filesize
4KB

Download
memory/2728-6-0x00000000008E0000-0x00000000009DA000-memory.dmp

Filesize
1000KB

Download
memory/2728-7-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download
memory/2728-8-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

Filesize
9.9MB

Download