00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271

Resubmissions

22-09-2022 16:59

20-09-2022 10:36

Target

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Size

39KB
MD5

ec263f6b3a0ec7ede4960a2db469fb4e
SHA1

6684ec275e168f999d27f8a2b1f83dcc0ac1ff8f
SHA256

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271
SHA512

51391cc61514cf68b7789c8646315fba04f66c821b0f9dc4bd8d684ea377069f596ff3dfe999e342e580d7139d4967bfe47e1d11ec5b5490173f104938546178
SSDEEP

768:eNkXrdzjDUp3vyE0WFBDiBZn/EvuuXY02pw0MU:eeXxzHUp3vyE0WFBeH/EvuI1I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4116	4636	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
"C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4636 -s 320
  2⤵
  - Program crash
  PID:4116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 4636 -ip 4636
1⤵
PID:1488