38ca9ff2307ce3b790449315ee0ce3cfbecef95019a5cca0e99cde1f4f55a7c2

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 06:51

Target

invoice#20221002____________________________________________________________________________________.exe
Size

18KB
MD5

7afa2f4be1635ca9af331d33f79419e2
SHA1

d0a75b94bc15f1ca1ed16ae405642e71577ff957
SHA256

86b7ec267f285d43d22ec3695509320d65482b985e1aca941213088fb0925980
SHA512

fb5adf32b0cafe2d0f007b5920ebd9f47fa242912c449393b8eb7f35fb61cf6373197a32e41b0259a09b9ad99e6dea4ed73b33a56c1eac4b5395f6c9cd6672c4
SSDEEP

384:TG6PsqGJpt09ShA49gfFK1NpQ8IQyxmpGvQoy:yostJpt09iAugfz8I1xmpGYn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	process	target process
2336	3988	WerFault.exe	invoice#20221002____________________________________________________________________________________.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

invoice#20221002____________________________________________________________________________________.exe

description	pid	process
Token: SeDebugPrivilege	3988	invoice#20221002____________________________________________________________________________________.exe

C:\Users\Admin\AppData\Local\Temp\invoice#20221002____________________________________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\invoice#20221002____________________________________________________________________________________.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 1568
2⤵
- Program crash
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3988 -ip 3988
1⤵
PID:2148

memory/3988-132-0x00000000009B0000-0x00000000009BA000-memory.dmp

Filesize
40KB

Download
memory/3988-133-0x0000000005980000-0x0000000005F24000-memory.dmp

Filesize
5.6MB

Download
memory/3988-134-0x00000000054D0000-0x0000000005562000-memory.dmp

Filesize
584KB

Download
memory/3988-135-0x0000000005570000-0x000000000560C000-memory.dmp

Filesize
624KB

Download
memory/3988-136-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download