c4263eedfb23dffe6ac1c07b45338e9b9a2288da8feb9a19b45e7ad95e257e4e

Analysis

max time kernel
121s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 07:09

Target

c4263eedfb23dffe6ac1c07b45338e9b9a2288da8feb9a19b45e7ad95e257e4e.exe
Size

31KB
MD5

fd530ae0f6e6fdb38036e32eb07b3695
SHA1

5b30d47314aee4994a28c6a43cb3e9b78cb5d200
SHA256

c4263eedfb23dffe6ac1c07b45338e9b9a2288da8feb9a19b45e7ad95e257e4e
SHA512

a1adf65a0e7e0fda25a5421de1b5d2ca233a63c0e246a9ab4a92c379e3bc35066db97df4ade3e26035b3f0521c6d57b3caa89eb1b06f3f489f3460169bf775a6
SSDEEP

768:d0Sy2olh4l/nHCwGx9EEJqVJ9RFocTbWBemUsaXnbcuyD7UcNWGn:dq/lhgCwGrE+qVJ9QpBe/saXnouy8cx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3808	996	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
996	c4263eedfb23dffe6ac1c07b45338e9b9a2288da8feb9a19b45e7ad95e257e4e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	c4263eedfb23dffe6ac1c07b45338e9b9a2288da8feb9a19b45e7ad95e257e4e.exe

C:\Users\Admin\AppData\Local\Temp\c4263eedfb23dffe6ac1c07b45338e9b9a2288da8feb9a19b45e7ad95e257e4e.exe
"C:\Users\Admin\AppData\Local\Temp\c4263eedfb23dffe6ac1c07b45338e9b9a2288da8feb9a19b45e7ad95e257e4e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 292
  2⤵
  - Program crash
  PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 996 -ip 996
1⤵
PID:1756

memory/996-132-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/996-133-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download