8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59

Analysis

max time kernel
66s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 14:15

Target

8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59.exe
Size

43KB
MD5

d430484f0ef1712afd1a67c48481511a
SHA1

204ffbb47fd20b5e82ed1251873b251e7ef32b5b
SHA256

8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59
SHA512

8641565ab9401d99831d7c2791a129686e11c92bf598fb05ece13df2486f1ebf3a7a5bb534bf78d91c72e3463d92de6e703e3afc812f4deeefa7163b5b354008
SSDEEP

384:UDcvdDvu/HpZcFS5JAj3okP/dDa6mr4sPzzBx:UYVC/JZ0STO3lHcIqBx

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2204	4936	WerFault.exe	73
1860	4936	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4936	8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59.exe
4936	8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59.exe

C:\Users\Admin\AppData\Local\Temp\8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59.exe
"C:\Users\Admin\AppData\Local\Temp\8ba04b022ea56b1e57ebed18c4a62f1452ec31f65d679558537a467de2162f59.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1788
  2⤵
  - Program crash
  PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1764
  2⤵
  - Program crash
  PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4936 -ip 4936
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4936 -ip 4936
1⤵
PID:3436