00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb

Analysis

max time kernel
119s
max time network
21s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 11:39

Target

00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb.exe
Size

9KB
MD5

df5690c36324baf2f617482ce976bde8
SHA1

2531b0e156f6846e27aa3e9b8f13f5151e116455
SHA256

00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb
SHA512

2e4911c61d765af7dcc4df1d69d97538abaad29b355193b060ac8c0b66f2138649f846a0966957764f0204b7bc4c12e0551384d3b53c463db262b924eafe663b
SSDEEP

192:QBksubPY82gQv5F4OtWeMZZ3P93VnjdwCzt3yQww:Q82l4OtWeMBFnhwChiQR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2860	2640	00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb.exe	30
PID 2640 wrote to memory of 2860	2640	00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb.exe	30
PID 2640 wrote to memory of 2860	2640	00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb.exe	30

C:\Users\Admin\AppData\Local\Temp\00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb.exe
"C:\Users\Admin\AppData\Local\Temp\00e9676494637633b7428b904a4c3af0be15ef2ffd01dafcd2adf48525dbc1bb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2640 -s 896
  2⤵
  PID:2860

memory/2640-0-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/2640-1-0x0000000001190000-0x0000000001198000-memory.dmp

Filesize
32KB

Download
memory/2640-2-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2640-3-0x000007FEF6003000-0x000007FEF6004000-memory.dmp

Filesize
4KB

Download
memory/2640-4-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download
memory/2640-5-0x000007FEF6000000-0x000007FEF69EC000-memory.dmp

Filesize
9.9MB

Download