62e9b612619c1e8cb521feeca79bdb546a71b4b8731b603c422e97a47811305f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 17:44

Target

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe
Size

432KB
MD5

e807bcfa922ddd60a6c8e85c441c576b
SHA1

f2a2cafc8f9efe1b5d49bcf3cadedc87ea416dac
SHA256

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004
SHA512

6da74e49eaac931a22cfbf33851b5f450c067d445a7434fb4a703db85df55830f8ca046c03418fd4ddc9227a62fbf726805a6fb5ddf39647380633771b8fcfac
SSDEEP

12288:n+jAiWbrrhAIrzN4f/Q1EZB6bi+pOaWeeJjTJ:+A1zN4nQaZB3xewTJ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

pid	Process
2652	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe
2652	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

description	pid	Process
Token: SeDebugPrivilege	2652	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe

description	pid	Process	procid_target
PID 2652 wrote to memory of 2744	2652	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe	30
PID 2652 wrote to memory of 2744	2652	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe	30
PID 2652 wrote to memory of 2744	2652	b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe	30

C:\Users\Admin\AppData\Local\Temp\b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe
"C:\Users\Admin\AppData\Local\Temp\b08be63af3754f6970336f0f5c751271233d253f0195d2ed8293e50679c18004.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2652 -s 552
  2⤵
  PID:2744

memory/2652-0-0x000007FEF5683000-0x000007FEF5684000-memory.dmp

Filesize
4KB

Download
memory/2652-1-0x0000000000260000-0x00000000002D0000-memory.dmp

Filesize
448KB

Download