7e71c79883eb025596762b4e0bf86b447039079dfe510ccf13a383b612575fa6

Analysis

max time kernel
57s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:25

Target

3d18edb3bf6b0493a6572edd73f937ff.exe
Size

16.4MB
MD5

3d18edb3bf6b0493a6572edd73f937ff
SHA1

5845f04892c5c4314dab1b885c4ee77e5f799052
SHA256

eec5563cab061ef1b00530425de7891a09ec8416aae780c6c651c7caf98d7879
SHA512

81eb59c2170c17959c6814847b420ff7682145d552692c6af1d88fc1b251d4bfd5ae45a9f7f017184812c69606bd132309f879f8031da5a1b23a309d52185a4b
SSDEEP

196608:S46M6QqOyjr2LF3Ye6YmnwqdU142U8ZG7xKmHH:51cjSLFoBYmn5U1PtZG7xK6

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2268	3d18edb3bf6b0493a6572edd73f937ff.exe
2268	3d18edb3bf6b0493a6572edd73f937ff.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2268	3d18edb3bf6b0493a6572edd73f937ff.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	3d18edb3bf6b0493a6572edd73f937ff.exe
Token: SeDebugPrivilege	2268	3d18edb3bf6b0493a6572edd73f937ff.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1488	2268	3d18edb3bf6b0493a6572edd73f937ff.exe	31
PID 2268 wrote to memory of 1488	2268	3d18edb3bf6b0493a6572edd73f937ff.exe	31
PID 2268 wrote to memory of 1488	2268	3d18edb3bf6b0493a6572edd73f937ff.exe	31

C:\Users\Admin\AppData\Local\Temp\3d18edb3bf6b0493a6572edd73f937ff.exe
"C:\Users\Admin\AppData\Local\Temp\3d18edb3bf6b0493a6572edd73f937ff.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 736
  2⤵
  PID:1488

memory/2268-0-0x000007FEF6BF3000-0x000007FEF6BF4000-memory.dmp

Filesize
4KB

Download
memory/2268-1-0x0000000000FC0000-0x0000000002028000-memory.dmp

Filesize
16.4MB

Download
memory/2268-2-0x000007FEF6BF0000-0x000007FEF75DC000-memory.dmp

Filesize
9.9MB

Download