7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659

Resubmissions

19/09/2024, 11:06

19/09/2024, 11:03

max time kernel
49s
max time network
56s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 11:03

Target

Bootstrapper.exe
Size

796KB
MD5

4b94b989b0fe7bec6311153b309dfe81
SHA1

bb50a4bb8a66f0105c5b74f32cd114c672010b22
SHA256

7c4283f5e620b2506bcb273f947def4435d95e143ae3067a783fd3adc873a659
SHA512

fbbe60cf3e5d028d906e7d444b648f7dff8791c333834db8119e0a950532a75fda2e9bd5948f0b210904667923eb7b2c0176140babc497955d227e7d80fb109d
SSDEEP

12288:jHeLH6iTPSE54sgweI9oaQaj3T+piq+77xOZ+eMm:jHeLHdTSEeyoaQaj3apiq+77xd

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	Bootstrapper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1932	1620	Bootstrapper.exe	31
PID 1620 wrote to memory of 1932	1620	Bootstrapper.exe	31
PID 1620 wrote to memory of 1932	1620	Bootstrapper.exe	31

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1620 -s 1068
  2⤵
  PID:1932

memory/1620-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x0000000000AA0000-0x0000000000B6E000-memory.dmp

Filesize
824KB

Download
memory/1620-2-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/1620-3-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/1620-4-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download