91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 21:45

Target

91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Size

120KB
MD5

0f8d9cf47fe55dd1a19f87863db620a9
SHA1

cdf4dd4b2969047e5ec29c12fd9a2fbf85769477
SHA256

91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469
SHA512

fa65df967e8911ce54cb7e9b7fa9fa8194d110c1fc95c6fb75329c71e22b0bde0ab742eccd689c618278d4bba3a5f9105f6a7b16fdc6f608766f9b894671e67c
SSDEEP

1536:QIDThSFWEv7NyArVF3qmRIjbPT6XpOPzmsLPtTh0PE:phSFWETNykFaygbipEzLLPRh0M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1584	628	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeCreatePagefilePrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeShutdownPrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeCreatePagefilePrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeShutdownPrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeCreatePagefilePrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeShutdownPrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeCreatePagefilePrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeShutdownPrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
Token: SeCreatePagefilePrivilege	628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe

C:\Users\Admin\AppData\Local\Temp\91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe
"C:\Users\Admin\AppData\Local\Temp\91c967db6cc74369e38aca443adbb0f605e524d0519064ee05cfef6018a9f469.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 464
  2⤵
  - Program crash
  PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 628 -ip 628
1⤵
PID:4248