163c5a7bdc1038959e103011dcf454bc009c5b0c0ad3cac60bbb4f2a4a19444f

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 20:14

Target

BootstrapperV1.21.exe
Size

797KB
MD5

c5dfc6db9d57d21fc1fd18afff38cab0
SHA1

2c0ad08b90c699539702899db5860c1e1e1a8d80
SHA256

163c5a7bdc1038959e103011dcf454bc009c5b0c0ad3cac60bbb4f2a4a19444f
SHA512

0369f636cc83d5841549a06ed1ca06b74859a26ef7ebc35ed9f26c281682e10804fcdaf3dfc47049b4aea01694cc11014d2e2c6435b0abc757a5472c548dd68e
SSDEEP

12288:igEx9nCvJ4f05oOGoGH/j0MNVcfzJXcBPXBNr8L:ZY9CvzoVoGH/j0ucrJXO

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	BootstrapperV1.21.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 3028	2736	BootstrapperV1.21.exe	31
PID 2736 wrote to memory of 3028	2736	BootstrapperV1.21.exe	31
PID 2736 wrote to memory of 3028	2736	BootstrapperV1.21.exe	31

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.21.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.21.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 1080
  2⤵
  PID:3028

memory/2736-0-0x000007FEF54E3000-0x000007FEF54E4000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x0000000000D40000-0x0000000000E0E000-memory.dmp

Filesize
824KB

Download
memory/2736-2-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download
memory/2736-3-0x000007FEF54E3000-0x000007FEF54E4000-memory.dmp

Filesize
4KB

Download
memory/2736-4-0x000007FEF54E0000-0x000007FEF5ECC000-memory.dmp

Filesize
9.9MB

Download