08c69bfd017a35fde4cb6b5dc9815f3fc56afd5bacce61dd4807c76b6e794e33

Analysis

max time kernel
224s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2022, 18:36

Target

08c69bfd017a35fde4cb6b5dc9815f3fc56afd5bacce61dd4807c76b6e794e33.exe
Size

9KB
MD5

0df03daf0df128e8da7174b4a4bfaeb2
SHA1

eb2b11df077a329d1794f03db3f6fa0ce87b5c22
SHA256

08c69bfd017a35fde4cb6b5dc9815f3fc56afd5bacce61dd4807c76b6e794e33
SHA512

dad6ec7682ef650f31bb1d5e2def6533c7be65510c6be385938424aa395715f7d94644286b5697e00112c1b2ba069a065c586b0cb96eb9e248581a751620ef2b
SSDEEP

96:NePsPTlOCXWhw0QSiIR6XAI3WNtW1jYcFKNVcz1W4oKYlLya:NGsPTlOCGhAIRi98stYcFwVc03KY

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	08c69bfd017a35fde4cb6b5dc9815f3fc56afd5bacce61dd4807c76b6e794e33.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3696	4900	WerFault.exe	54

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	08c69bfd017a35fde4cb6b5dc9815f3fc56afd5bacce61dd4807c76b6e794e33.exe

C:\Users\Admin\AppData\Local\Temp\08c69bfd017a35fde4cb6b5dc9815f3fc56afd5bacce61dd4807c76b6e794e33.exe
"C:\Users\Admin\AppData\Local\Temp\08c69bfd017a35fde4cb6b5dc9815f3fc56afd5bacce61dd4807c76b6e794e33.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:4900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4900 -s 1668
  2⤵
  - Program crash
  PID:3696

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4900 -ip 4900
1⤵
PID:3188

memory/4900-132-0x0000000000FB0000-0x0000000000FB8000-memory.dmp

Filesize
32KB

Download
memory/4900-133-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download
memory/4900-134-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmp

Filesize
10.8MB

Download