54fae569dce7e163b82278e3353f28978511f3af6ef2f444ee5b2034a88af61e

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2022 07:52

Target

Purchase Order 30 August 2022-02414291423394140374553.exe
Size

89KB
MD5

0c3e17513995f23e55698258b1182ff8
SHA1

102f3d910b9b5718d32cb53c742321fdbe1f3cf8
SHA256

54fae569dce7e163b82278e3353f28978511f3af6ef2f444ee5b2034a88af61e
SHA512

e17a9fbb516248fc44ba6dd3175130151764f6c41b9333037485ed1ddc6941d0a7d86d67efe5a2f7d4c399833ba985e8af49f0a5a8c9cc9fb4446cd9ae47562e
SSDEEP

768:M5Q7BWvdus8AS2ymNBqPrDhKD+sHmIBPu/5FXa7IkZsdmR/9UfaJAMnHSiU/2C7B:cxBMPtr/d0zRpSZ5adaht

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2300 2396 WerFault.exe Purchase Order 30 August 2022-02414291423394140374553.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Purchase Order 30 August 2022-02414291423394140374553.exe

description pid process

Token: SeDebugPrivilege 2396 Purchase Order 30 August 2022-02414291423394140374553.exe

pid	pid_target	process	target process
2300	2396	WerFault.exe	Purchase Order 30 August 2022-02414291423394140374553.exe

description	pid	process
Token: SeDebugPrivilege	2396	Purchase Order 30 August 2022-02414291423394140374553.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order 30 August 2022-02414291423394140374553.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1496
2⤵
- Program crash
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2396 -ip 2396
1⤵
PID:344

memory/2396-132-0x00000000008E0000-0x00000000008FC000-memory.dmp

Filesize
112KB

Download
memory/2396-133-0x00000000057C0000-0x0000000005D64000-memory.dmp

Filesize
5.6MB

Download
memory/2396-134-0x00000000052F0000-0x0000000005382000-memory.dmp

Filesize
584KB

Download
memory/2396-135-0x0000000005390000-0x0000000005406000-memory.dmp

Filesize
472KB

Download