a0161d709793136e815c902d928421ca5447ac394449a35ee529d85aed318251

Resubmissions

04-02-2025 23:52

04-02-2025 23:15

max time kernel
839s
max time network
841s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-02-2025 23:52

Target

extracted_payload-cleaned - Copy.exe
Size

5.8MB
MD5

bcff5526d0e5da9524a89b2dcc809cee
SHA1

b8c321683058f79eb810e73d338caf292fc04611
SHA256

a0161d709793136e815c902d928421ca5447ac394449a35ee529d85aed318251
SHA512

a9101d4991c49c229b324e5313a9f92cdb489fa1aab68970cdf8189029ad4f30aa03a97c2441be800eec9995042656bc180d00632e8400f43b0c57c023185a53
SSDEEP

98304:dVzA+NolR3oceUQ1spbvuKSUJ17LrbH4q8y1iYVk1OUkh54oZdxkOHYSM:7PNO3K1spbmxcrbH4a1iYVk1O15DUC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	extracted_payload-cleaned - Copy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1668	2496	extracted_payload-cleaned - Copy.exe	32
PID 2496 wrote to memory of 1668	2496	extracted_payload-cleaned - Copy.exe	32
PID 2496 wrote to memory of 1668	2496	extracted_payload-cleaned - Copy.exe	32

C:\Users\Admin\AppData\Local\Temp\extracted_payload-cleaned - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\extracted_payload-cleaned - Copy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2496 -s 664
  2⤵
  PID:1668

memory/2496-0-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp

Filesize
4KB

Download
memory/2496-1-0x0000000000880000-0x0000000000E50000-memory.dmp

Filesize
5.8MB

Download