a6a9a1b63360b3ea785f6de90cdd09f12063ad19d218c25a18d6ac0b31ca0de9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 20:01

Target

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe
Size

432KB
MD5

e807bcfa922ddd60a6c8e85c441c576b
SHA1

f2a2cafc8f9efe1b5d49bcf3cadedc87ea416dac
SHA256

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004
SHA512

6da74e49eaac931a22cfbf33851b5f450c067d445a7434fb4a703db85df55830f8ca046c03418fd4ddc9227a62fbf726805a6fb5ddf39647380633771b8fcfac
SSDEEP

12288:n+jAiWbrrhAIrzN4f/Q1EZB6bi+pOaWeeJjTJ:+A1zN4nQaZB3xewTJ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

pid	process
2408	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe
2408	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

description pid process

Token: SeDebugPrivilege 2408 b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

description	pid	process
Token: SeDebugPrivilege	2408	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

description	pid	process	target process
PID 2408 wrote to memory of 2116	2408	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe	WerFault.exe
PID 2408 wrote to memory of 2116	2408	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe	WerFault.exe
PID 2408 wrote to memory of 2116	2408	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe
"C:\Users\Admin\AppData\Local\Temp\b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 552
  2⤵
  PID:2116

memory/2408-0-0x000007FEF6723000-0x000007FEF6724000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x00000000008F0000-0x0000000000960000-memory.dmp

Filesize
448KB

Download