ba292c71636f627a58ffbd25a5fe289a87882864f5f01e3cc82c2e94e11c8f45

Analysis

max time kernel
103s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 19:47

Target

5b68f7ba515e317a58bf07f37a2eef9d.exe
Size

186KB
MD5

5b68f7ba515e317a58bf07f37a2eef9d
SHA1

ec4ae9d0ec91e867c6dd7124591751314bafbe0e
SHA256

ba292c71636f627a58ffbd25a5fe289a87882864f5f01e3cc82c2e94e11c8f45
SHA512

5b4a82ae7bd6e63b581f6cfc296e65bc7651dea44e64b35328ddb2b24d8e0f2a8a4640bd8879607db1230efbbd3c7e8026e10c1b85cae3c0b881e54d8eb57078
SSDEEP

3072:Ou7sJwyOX9oC6UsHF20u5EQ1V279gh/BFku3duyhN8Oen16fJYVwEMvh:Om6UslAEcV279a/B/duyhS1nkCVwPvh

Score

4^/10

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\adobe\acrotray .exe	5b68f7ba515e317a58bf07f37a2eef9d.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	5b68f7ba515e317a58bf07f37a2eef9d.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	5b68f7ba515e317a58bf07f37a2eef9d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3912	3796	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3796	5b68f7ba515e317a58bf07f37a2eef9d.exe
3796	5b68f7ba515e317a58bf07f37a2eef9d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3796	5b68f7ba515e317a58bf07f37a2eef9d.exe

C:\Users\Admin\AppData\Local\Temp\5b68f7ba515e317a58bf07f37a2eef9d.exe
"C:\Users\Admin\AppData\Local\Temp\5b68f7ba515e317a58bf07f37a2eef9d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 660
  2⤵
  - Program crash
  PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3796 -ip 3796
1⤵
PID:3576

memory/3796-132-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download