afd6f032a7122889f53d345acb9232749052768aa15fd2221266c5ddcbc4cc0e

Analysis

max time kernel
82s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2022 00:41

Target

PO#15032016-A001.exe
Size

1.2MB
MD5

4a459848e43d10b447d4997bea214005
SHA1

960172ec5db6c14fb13c88c720b185f54c134e49
SHA256

3b59835c11f8038ab2a4a12e4b6e0f8fe8758287c78d90c463f4e05f965d53a4
SHA512

a8b0105fc6c83a2c24495b75c6ee72c4245e4cb7b96413bfe7140ac8686547c932456db0e754b22e9d0ba2371e7b3edd17cc075854ac7af5a69bea73e575cda3
SSDEEP

24576:NLDO8fK9xek6lUNRIMDMG1XHa9i62pItX/f:5fsxe7GAMYG1K9uC/f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2452	952	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	PO#15032016-A001.exe
952	PO#15032016-A001.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	PO#15032016-A001.exe

C:\Users\Admin\AppData\Local\Temp\PO#15032016-A001.exe
"C:\Users\Admin\AppData\Local\Temp\PO#15032016-A001.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1376
  2⤵
  - Program crash
  PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 952 -ip 952
1⤵
PID:4960

memory/952-132-0x00000000002E0000-0x0000000000416000-memory.dmp

Filesize
1.2MB

Download
memory/952-133-0x00000000053A0000-0x0000000005944000-memory.dmp

Filesize
5.6MB

Download
memory/952-134-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/952-135-0x0000000004D90000-0x0000000004D9A000-memory.dmp

Filesize
40KB

Download
memory/952-136-0x000000000C1B0000-0x000000000C24C000-memory.dmp

Filesize
624KB

Download