dac6e01c55ca5ab039fad04e3c773acd0f85e6876ff2c95fa6b0a5651ce247e1

Analysis

max time kernel
131s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 17:35

Target

dac6e01c55ca5ab039fad04e3c773acd0f85e6876ff2c95fa6b0a5651ce247e1.exe
Size

136KB
MD5

21b6d32fbef03ac81b8b66a51bf01a0c
SHA1

4c7adb01b5606a36c9a3ab729ee1f7acf6a6da4c
SHA256

dac6e01c55ca5ab039fad04e3c773acd0f85e6876ff2c95fa6b0a5651ce247e1
SHA512

a5623f1f5aea5bc74e76265c973f1f280e87456b529158f7112fe32bfca710a21bcef2a2e0eafd9f97a01b39a18607fbb3df3c1f842801eb5fd27ca2c91bcdce
SSDEEP

1536:6dHnJhfBLYx2JOhEQcfyh1BiyBnPYbn0ZOKadZk:MJhfBVOIyh1hBnAtdS

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\rprrqpqrdesk.ini	dac6e01c55ca5ab039fad04e3c773acd0f85e6876ff2c95fa6b0a5651ce247e1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	4952	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	dac6e01c55ca5ab039fad04e3c773acd0f85e6876ff2c95fa6b0a5651ce247e1.exe

C:\Users\Admin\AppData\Local\Temp\dac6e01c55ca5ab039fad04e3c773acd0f85e6876ff2c95fa6b0a5651ce247e1.exe
"C:\Users\Admin\AppData\Local\Temp\dac6e01c55ca5ab039fad04e3c773acd0f85e6876ff2c95fa6b0a5651ce247e1.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 1300
  2⤵
  - Program crash
  PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4952 -ip 4952
1⤵
PID:3880

memory/4952-132-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4952-133-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download