8599ef74efe41dd289680cd68671eb83841e3211f5af29c37319625717aaa39d

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-02-2025 22:27

Target

dump.exe
Size

5.8MB
MD5

10c2b6a21c47a6b567b5ea3c0bfb40df
SHA1

c41a11aaaab6da88b5f31ce0a8b05d2d8fe6d7f7
SHA256

8599ef74efe41dd289680cd68671eb83841e3211f5af29c37319625717aaa39d
SHA512

ea57119d520b6483e91504a7ba841a7ce0f3432e43909db529efaca0cd8ba4b3a6e11fc2bd443a0266d8ba70ee7f0d2dfc4743e2043f084f4a3248f37e019a07
SSDEEP

98304:KiSU0Om2cae1pjuzggn+78Rvjxf1npRNX3/hb//eRrklpXzlTDk7NMOFW+uD5mV/:1cae6i8RjLpRNn/hDUrsDZDqNMO4Dc84

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	dump.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2108	2096	dump.exe	33
PID 2096 wrote to memory of 2108	2096	dump.exe	33
PID 2096 wrote to memory of 2108	2096	dump.exe	33

C:\Users\Admin\AppData\Local\Temp\dump.exe
"C:\Users\Admin\AppData\Local\Temp\dump.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 656
  2⤵
  PID:2108

memory/2096-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000000FB0000-0x0000000001580000-memory.dmp

Filesize
5.8MB

Download