8088f08a5636cec3bf8b9f05b6ca2d0b21a76a56199d6ccd1777a6f6a7b9fdde

Analysis

max time kernel
204s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 07:09

Target

win32k.dll
Size

262KB
MD5

07458acb129ef3ef233d284361b4e158
SHA1

e46b46400d8af345bad009fd0b100e1d6a6ae13a
SHA256

8088f08a5636cec3bf8b9f05b6ca2d0b21a76a56199d6ccd1777a6f6a7b9fdde
SHA512

116609f09bc694d3205f989d1c6228b4ab773fd2afd1f22149432d7c2ff20be60dd871aaa6ea51f05f690e31946de8d3b3cde23919ec81f060a1ca812282e08c
SSDEEP

3072:4fdCm94F6x59KscGxM3CqA+EGbiXBm2jVAMhCxbCK6YCX4Vc9ZgPvO8Rc9JiZgA4:K1fx5Ysw3C7+EhRmZMQHbwTgPW0wiP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1824	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\win32k.dll,#1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1824 -s 592
  2⤵
  - Program crash
  PID:1628

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 1824 -ip 1824
1⤵
PID:3384