6f76eccd32ffc9445a842b4442044c5ad92a58ce58a0552913e703c942b81f96

Analysis

max time kernel
845s
max time network
846s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 01:06

Target

extracted_payload-cleaned - Copy.exe
Size

5.8MB
MD5

93bf3af1a0f7714baff7d12c7554111e
SHA1

996af0047fc17b0cd2385cbfcf51219b70ebd557
SHA256

6f76eccd32ffc9445a842b4442044c5ad92a58ce58a0552913e703c942b81f96
SHA512

51da3ee71d55e8a742f72f99a31193310868592cc8fb3e12fb6e88c891ace874b6be93b535a4777cf544e50d0b65b0ea36a79281c9b729ba51d7dafbb2f97ab4
SSDEEP

98304:SVzA+NolR3oceUQ1spbvuKSUJ17LrbH4q8y1iYVk1OUkh54oZdxkOHYSM:SPNO3K1spbmxcrbH4a1iYVk1O15DUC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	extracted_payload-cleaned - Copy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 544	2400	extracted_payload-cleaned - Copy.exe	32
PID 2400 wrote to memory of 544	2400	extracted_payload-cleaned - Copy.exe	32
PID 2400 wrote to memory of 544	2400	extracted_payload-cleaned - Copy.exe	32

C:\Users\Admin\AppData\Local\Temp\extracted_payload-cleaned - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\extracted_payload-cleaned - Copy.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2400 -s 664
  2⤵
  PID:544

memory/2400-0-0x000007FEF5213000-0x000007FEF5214000-memory.dmp

Filesize
4KB

Download
memory/2400-1-0x0000000000F90000-0x0000000001560000-memory.dmp

Filesize
5.8MB

Download