706eb6d09ca92cb6b26a93d92d03cb1321b2ba72b6e255eed8dad28fffd5cb8d

Analysis

max time kernel
103s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 00:27

Target

706eb6d09ca92cb6b26a93d92d03cb1321b2ba72b6e255eed8dad28fffd5cb8d.exe
Size

128KB
MD5

3de98b85078f65b26d6334c488b42d0c
SHA1

216922eb4779424030b357859369d3112673bb3b
SHA256

706eb6d09ca92cb6b26a93d92d03cb1321b2ba72b6e255eed8dad28fffd5cb8d
SHA512

77e0f0492e6042f09265b511ffa456a103110e7211cc3e077ca35b366e4cd4382a2173d393119cfb4c99be9b4aeed7fdbc5b7a61a7b696b0d60e7bc2147d81cb
SSDEEP

768:sil6AzcuEucDH40xMVHKe4a1uIhqfFUGzStwn5ke9eWI6BeA/3dtlWZ//d7uJY:p6Azng4KZaJQdJUf6QcWZ97uJY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4244	5040	WerFault.exe	75

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	706eb6d09ca92cb6b26a93d92d03cb1321b2ba72b6e255eed8dad28fffd5cb8d.exe

C:\Users\Admin\AppData\Local\Temp\706eb6d09ca92cb6b26a93d92d03cb1321b2ba72b6e255eed8dad28fffd5cb8d.exe
"C:\Users\Admin\AppData\Local\Temp\706eb6d09ca92cb6b26a93d92d03cb1321b2ba72b6e255eed8dad28fffd5cb8d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 312
  2⤵
  - Program crash
  PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 5040 -ip 5040
1⤵
PID:1848