00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271

Resubmissions

22/09/2022, 16:59

20/09/2022, 10:36

Target
00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Size 39KB
Sample220920-mm8d3agdbq
SHA256 00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271
MD5 ec263f6b3a0ec7ede4960a2db469fb4e
SHA1 6684ec275e168f999d27f8a2b1f83dcc0ac1ff8f
SHA512 51391cc61514cf68b7789c8646315fba04f66c821b0f9dc4bd8d684ea377069f596ff3dfe999e342e580d7139d4967bfe47e1d11ec5b5490173f104938546178
SSDEEP 768:eNkXrdzjDUp3vyE0WFBDiBZn/EvuuXY02pw0MU:eeXxzHUp3vyE0WFBeH/EvuI1I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4116	4636	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
"C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4636 -s 320
  2⤵
  - Program crash
  PID:4116

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 4636 -ip 4636
1⤵
PID:1488