1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de

Analysis

max time kernel
123s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 01:20

Target

1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Size

120KB
MD5

0ec91862831cdb219388a268f4122e66
SHA1

06e7bfcfb0343bdd6ce5091621e22b21fa6f4fd3
SHA256

1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de
SHA512

76dd95520fee1ab95aca39133148e8b1e1b66f1b767c866c22ecee2a991e3c9ba4feeba9c722a9e06d2628287b7cd1ad5ef0d17d8daa43399743f0fa5e407db5
SSDEEP

1536:QIDThSFWEv7NyArVF3qmRIjbPT6XpOPzmsLPtTh0PE:phSFWETNykFaygbipEzLLPRh0M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	4984	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeCreatePagefilePrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeShutdownPrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeCreatePagefilePrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeShutdownPrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeCreatePagefilePrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeShutdownPrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeCreatePagefilePrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeShutdownPrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
Token: SeCreatePagefilePrivilege	4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe

C:\Users\Admin\AppData\Local\Temp\1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe
"C:\Users\Admin\AppData\Local\Temp\1fcd6d315241be5505ec80cae0fe55f4bf4c95833292fb534bb957e26d8ae7de.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 464
  2⤵
  - Program crash
  PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4984 -ip 4984
1⤵
PID:4920