7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 13:58

Target

7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe
Size

65KB
MD5

3d50ee19f2a1f607a13d0d226050abd1
SHA1

e6110f2b6663661226648cce5f82b00e9138e1aa
SHA256

7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a
SHA512

6078bdffe889c08786b8ccab16237796802f4b6d4db35edabdf41caa4b44aa50ec7fccf1ae8d4ad7033436b4ee1869980f3a0a32f7c47720f2e586004dcb493f
SSDEEP

768:X7idX+dtbOIDnPxl+2+UYWz3zfxmM9wG6lxAarxILWFbCmg:X7idOdtbOIDH3YsUMKG+xAaVIaNCmg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	644	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	644	7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe
Token: SeCreatePagefilePrivilege	644	7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe
Token: SeShutdownPrivilege	644	7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe
Token: SeCreatePagefilePrivilege	644	7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe
Token: SeShutdownPrivilege	644	7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe
Token: SeCreatePagefilePrivilege	644	7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
644	7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe

C:\Users\Admin\AppData\Local\Temp\7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe
"C:\Users\Admin\AppData\Local\Temp\7906b8704db10250c7d028267318553462c524ee85d002596ccc67b48a06be0a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 464
  2⤵
  - Program crash
  PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 644 -ip 644
1⤵
PID:2316