77e870935f26e08977579ca5e3837ea5fdf25fad463d1ad6c7cce24b77e4054a

Analysis

max time kernel
147s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 05:09

Target

77e870935f26e08977579ca5e3837ea5fdf25fad463d1ad6c7cce24b77e4054a.exe
Size

109KB
MD5

e958eb0db8ce45d7b4c88c6fa9565432
SHA1

a44490f7b4d669c1810655ebb6f2f8d20d0ed66b
SHA256

77e870935f26e08977579ca5e3837ea5fdf25fad463d1ad6c7cce24b77e4054a
SHA512

e9f0507f580e7ad1405a29f2ae826de3b2792c23396c5a03f3849feeaf72f9bfaa4d89b7db5b8ef7b21896daf04f9c28fadd18543f51a774b065d706a4f65d6c
SSDEEP

1536:jcqrQ45YHwTK8JzDGBktaHIrubcCwiKNMyfYL3BO2Kt:rF5xe8JzDGCfu+TrQ7B6t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	4568	WerFault.exe	78

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	77e870935f26e08977579ca5e3837ea5fdf25fad463d1ad6c7cce24b77e4054a.exe

C:\Users\Admin\AppData\Local\Temp\77e870935f26e08977579ca5e3837ea5fdf25fad463d1ad6c7cce24b77e4054a.exe
"C:\Users\Admin\AppData\Local\Temp\77e870935f26e08977579ca5e3837ea5fdf25fad463d1ad6c7cce24b77e4054a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 616
  2⤵
  - Program crash
  PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 4568
1⤵
PID:836