b5721d616aa2e9770be2e87a56f670f1c2db6bc7e44c2b2bad731fbd4cb196f5

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 04:06

Target

Project Ligma.exe
Size

25KB
MD5

4b905d058730d8f822acb3c5403025b3
SHA1

8d42b34ac05c33a2785ce4294a23cff4c3b1c735
SHA256

56e006657d3057aa8853ae37f16bd07dd9467344190fabf6f809ae1c6bde56a0
SHA512

4d31828f8684d6492a501bf8205994db394de77ea0516720aa703a5968095e358b226b23060ae0243771867df01c71800697fdb610bf8c6620657757c54646aa
SSDEEP

384:BDzUkIdjc9kyecBWZNgTEp3trMrsNleNf88uuagE9WRPagdF9dofRmVukvwKwq6V:BVeiSv9Nlsf88uycYLd3dAcjq

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	Project Ligma.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2844	2180	Project Ligma.exe	30
PID 2180 wrote to memory of 2844	2180	Project Ligma.exe	30
PID 2180 wrote to memory of 2844	2180	Project Ligma.exe	30

C:\Users\Admin\AppData\Local\Temp\Project Ligma.exe
"C:\Users\Admin\AppData\Local\Temp\Project Ligma.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2180 -s 1356
  2⤵
  PID:2844

memory/2180-0-0x000007FEF6233000-0x000007FEF6234000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x000000013FBB0000-0x000000013FBBA000-memory.dmp

Filesize
40KB

Download
memory/2180-2-0x000007FEF6230000-0x000007FEF6C1C000-memory.dmp

Filesize
9.9MB

Download
memory/2180-3-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/2180-4-0x000007FEF6230000-0x000007FEF6C1C000-memory.dmp

Filesize
9.9MB

Download
memory/2180-5-0x000007FEF6230000-0x000007FEF6C1C000-memory.dmp

Filesize
9.9MB

Download