708f5f0d732a5cc463a7946cf86c7a79a7c673000779aa8fe5b1aadf24040a99

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/02/2025, 00:59 UTC

Target

extracted_payload-cleaned - Copy.exe
Size

5.8MB
MD5

b8a8c3137385fa40be47215961ba6630
SHA1

688122f458e95518e2fae6b938cdb079f0991388
SHA256

708f5f0d732a5cc463a7946cf86c7a79a7c673000779aa8fe5b1aadf24040a99
SHA512

056de10cd6b798d18aa18e97cad645477149c562efc95d25bf724ab5f92454216c92f0c7717d7375181244d474513266146655ea6aad12bcab1f08e6835f1e4d
SSDEEP

98304:EVzA+NolR3oceUQ1spbvuKSUJ17LrbH4q8y1iYVk1OUkh54oZdxkOHYSM:8PNO3K1spbmxcrbH4a1iYVk1O15DUC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	extracted_payload-cleaned - Copy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2608	2684	extracted_payload-cleaned - Copy.exe	32
PID 2684 wrote to memory of 2608	2684	extracted_payload-cleaned - Copy.exe	32
PID 2684 wrote to memory of 2608	2684	extracted_payload-cleaned - Copy.exe	32

C:\Users\Admin\AppData\Local\Temp\extracted_payload-cleaned - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\extracted_payload-cleaned - Copy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2684 -s 656
  2⤵
  PID:2608

memory/2684-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

Filesize
4KB

Download
memory/2684-1-0x00000000013C0000-0x0000000001990000-memory.dmp

Filesize
5.8MB

Download