ed9559d5ae8705e33ac5a05c22c6d67aab383fe6342a160e388d086f308d26a2

Analysis

max time kernel
138s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 06:59

Target

ed9559d5ae8705e33ac5a05c22c6d67aab383fe6342a160e388d086f308d26a2.exe
Size

128KB
MD5

30be235af22923ddad497197b5d6dd90
SHA1

304afb175b90717072cbed8d4d96a7ba6f88b2de
SHA256

ed9559d5ae8705e33ac5a05c22c6d67aab383fe6342a160e388d086f308d26a2
SHA512

68fd51c9be62fe3f75962e419cf24007b8658b2e0ad675eef976789a7a777478856cfc5cd4b04f09d89a6c5fb9a1843b08e077bdf79792b730de1d220bc0e7e4
SSDEEP

1536:FVbhkVJCbqdl7Df6JmtVBPuO74EVre/BwjNCG1j3T1PhpdOlGGuRx+Bkqp951SkJ:/bif6Jmtek4E1e7szBPzQlvvtJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1972	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1972	ed9559d5ae8705e33ac5a05c22c6d67aab383fe6342a160e388d086f308d26a2.exe

C:\Users\Admin\AppData\Local\Temp\ed9559d5ae8705e33ac5a05c22c6d67aab383fe6342a160e388d086f308d26a2.exe
"C:\Users\Admin\AppData\Local\Temp\ed9559d5ae8705e33ac5a05c22c6d67aab383fe6342a160e388d086f308d26a2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 296
  2⤵
  - Program crash
  PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1972 -ip 1972
1⤵
PID:4144