5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f

Analysis

max time kernel
79s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 02:13

Target

5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Size

120KB
MD5

6a3d6d8102d2eb0dfe3bc6fd0b059374
SHA1

ab4e6e87985e492d92b3bdee9ed0aff8e905a2f0
SHA256

5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f
SHA512

c7eaa16a6b0404e03ef6ac2f980b8af2fd0e935163b6570fa3b8324fc25016c43d0c735479453ab33a9329a37e77ab1131b5613ea940968116b260a95bdb5da4
SSDEEP

1536:QIDThSFWEv7NyArVF3qmRIjbPT6XpOPzmsLPtTh0PE:phSFWETNykFaygbipEzLLPRh0M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	1500	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeCreatePagefilePrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeShutdownPrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeCreatePagefilePrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeShutdownPrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeCreatePagefilePrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeShutdownPrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeCreatePagefilePrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeShutdownPrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
Token: SeCreatePagefilePrivilege	1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1500	5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe

C:\Users\Admin\AppData\Local\Temp\5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe
"C:\Users\Admin\AppData\Local\Temp\5dfefd2273eac98299ff21a3411b76e5917015cf18ab14f30c35a52b322b375f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 464
  2⤵
  - Program crash
  PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1500 -ip 1500
1⤵
PID:2388