00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271

Resubmissions

22-09-2022 16:59

20-09-2022 10:36

max time kernel
91s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2022 16:59

Target

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Size

39KB
MD5

ec263f6b3a0ec7ede4960a2db469fb4e
SHA1

6684ec275e168f999d27f8a2b1f83dcc0ac1ff8f
SHA256

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271
SHA512

51391cc61514cf68b7789c8646315fba04f66c821b0f9dc4bd8d684ea377069f596ff3dfe999e342e580d7139d4967bfe47e1d11ec5b5490173f104938546178
SSDEEP

768:eNkXrdzjDUp3vyE0WFBDiBZn/EvuuXY02pw0MU:eeXxzHUp3vyE0WFBeH/EvuI1I

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4968 368 WerFault.exe 00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description pid process

Token: SeDebugPrivilege 368 00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

pid	pid_target	process	target process
4968	368	WerFault.exe	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description	pid	process
Token: SeDebugPrivilege	368	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
"C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 368 -s 324
  2⤵
  - Program crash
  PID:4968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 368 -ip 368
1⤵
PID:2128