63b2109d651e58bdceb6dcd68821e723f4a5ce45875405cf395ff04937ea26b8

Analysis

max time kernel
7s
max time network
9s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:14

Target

9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe
Size

16.8MB
MD5

9f1ccfcf5e175ae4c6ef4cb297ce5f7d
SHA1

6be3dc287bfeb4b4ff0c016a2f9616df8a7ad5c5
SHA256

d6b3e829442d9c0c7d6553c084dc666391704f2390d96216763edc1af0046721
SHA512

dfb334cea9425d4bc185459a09f539adc3e95d06ed0baec8475ddcdb7e44acda57a919977029baf9cf2af0617e0a95fe9efcfee818dcc357a8df99c6869d8021
SSDEEP

196608:8/j3V6QqOyjr2LF3Ye6YmnwqdU142UUZG7xKj/46:UV1cjSLFoBYmn5U1PlZG7xKH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe
3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe
Token: SeDebugPrivilege	3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2740	3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe	30
PID 3028 wrote to memory of 2740	3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe	30
PID 3028 wrote to memory of 2740	3028	9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe	30

C:\Users\Admin\AppData\Local\Temp\9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe
"C:\Users\Admin\AppData\Local\Temp\9f1ccfcf5e175ae4c6ef4cb297ce5f7d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3028 -s 628
  2⤵
  PID:2740

memory/3028-0-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp

Filesize
4KB

Download
memory/3028-1-0x0000000000A00000-0x0000000001AD2000-memory.dmp

Filesize
16.8MB

Download
memory/3028-2-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp

Filesize
9.9MB

Download