46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4

Analysis

max time kernel
146s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:19

Target

46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe
Size

8KB
MD5

302174015be125b26ee91320e43c0130
SHA1

c2b301f8ca409cd01e049c474fa4d0f07c7e1446
SHA256

46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4
SHA512

03be219bb54fe225d4d48b322a93ab2c17359e6154cce2f4f541851107a07c66057ff8509869ff226bfac8edf1f80330d679bf6b3be9eac086faf9706640f837
SSDEEP

96:fnrqObo9In2fU7+d1I6fdnvi+Cwc9VfQsvnVpOpM1Emp7qHIKOzNt://E9I2I+d1I6lnTFEvnepM1T8+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	4720	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe

C:\Users\Admin\AppData\Local\Temp\46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe
"C:\Users\Admin\AppData\Local\Temp\46073ba6b404fffd14d95f5594c26d9f1a76348ef506eb4ef7e8828f993d07f4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4720 -s 1412
  2⤵
  - Program crash
  PID:4916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 376 -p 4720 -ip 4720
1⤵
PID:4952

memory/4720-132-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/4720-133-0x00007FFE4EFE0000-0x00007FFE4FAA1000-memory.dmp

Filesize
10.8MB

Download
memory/4720-134-0x00007FFE4EFE0000-0x00007FFE4FAA1000-memory.dmp

Filesize
10.8MB

Download
memory/4720-135-0x00007FFE4EFE0000-0x00007FFE4FAA1000-memory.dmp

Filesize
10.8MB

Download