297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 03:44

Target
297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Size 381KB
Sample221011-ea1jpadcfr
SHA256 297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426
MD5 546c072b018550f4d7d0906a680fd3c0
SHA1 7dd5804dc559699abc96d006c05579eed1f85abe
SHA512 789263c911a0eb94de1125e3cb441476f25eb619d5d966781371e98695a523016c59766252cdd681f8f7bc085894a86213090a89ebf4dd6ef5a324db44fd5b57
SSDEEP 6144:+sf/8tS6zpoyWktBnmYAlcw0hvd96/LM69hMNyJwOm:+sX8AYFTtBmYKcD196/oySNyqOm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	3912	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeCreatePagefilePrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeShutdownPrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeCreatePagefilePrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeShutdownPrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeCreatePagefilePrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeShutdownPrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeCreatePagefilePrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeShutdownPrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
Token: SeCreatePagefilePrivilege	3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe

C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe
"C:\Users\Admin\AppData\Local\Temp\297e13b4ebfa037f39a01efecd32328bb5886e409cc754d0b8a712dad1f6c426.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 468
  2⤵
  - Program crash
  PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3912 -ip 3912
1⤵
PID:628