a7c5c83e51c727ed561e14386d11005b80f1d198b314653697ae0d6d132149f7

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 04:33

Target

a7c5c83e51c727ed561e14386d11005b80f1d198b314653697ae0d6d132149f7.exe
Size

82KB
MD5

68021402e3207e89963a56caefce62fc
SHA1

3f37430b43468569895d4981c1825adfb5f194cc
SHA256

a7c5c83e51c727ed561e14386d11005b80f1d198b314653697ae0d6d132149f7
SHA512

6d3852ed3c064ba4b61d54bada204299d3c9b9be2c8073b2ff285a9c816f04e47d760be83daaa7fef8ec58d0b942985b29e6903ff030cc79f7c822bc8f74919f
SSDEEP

1536:C3jQYJwF6ERHTQ7i1qwSlI3p2Y6gYhIwkbtU8K:C5wF6E1Q7i1HlpnV0Qbt6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4392	3824	WerFault.exe	77

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	a7c5c83e51c727ed561e14386d11005b80f1d198b314653697ae0d6d132149f7.exe

C:\Users\Admin\AppData\Local\Temp\a7c5c83e51c727ed561e14386d11005b80f1d198b314653697ae0d6d132149f7.exe
"C:\Users\Admin\AppData\Local\Temp\a7c5c83e51c727ed561e14386d11005b80f1d198b314653697ae0d6d132149f7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3824 -s 1420
  2⤵
  - Program crash
  PID:4392

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 3824 -ip 3824
1⤵
PID:1648

memory/3824-132-0x0000000000A40000-0x0000000000A5C000-memory.dmp

Filesize
112KB

Download
memory/3824-133-0x00007FFC1E250000-0x00007FFC1ED11000-memory.dmp

Filesize
10.8MB

Download
memory/3824-134-0x00007FFC1E250000-0x00007FFC1ED11000-memory.dmp

Filesize
10.8MB

Download