a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b

Analysis

max time kernel
202s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 09:41

Target

a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b.exe
Size

17KB
MD5

c32b8c03f7c923dcf575cb69b83978ee
SHA1

30b4c447e9128d232bca28cb303d510eb2a8bc20
SHA256

a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b
SHA512

da556a7e503d93b56565a68c136dba22b0e3f06a9653fd2d147f52be47e47b043dfbbd56d873189d8e9aec13488a9e539dd85bdd4918271b002f12cb497317ba
SSDEEP

192:BvIPu/SNvyLdRlVIRq1Deof1BgPYLFBG6Vxkhh4WWieZW+bV:NIdpyLdSRoQAhxkhh4WWieZW+

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2268	3552	WerFault.exe	78
1672	3552	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3552	a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b.exe
3552	a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b.exe

C:\Users\Admin\AppData\Local\Temp\a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b.exe
"C:\Users\Admin\AppData\Local\Temp\a905aaaabeed260eed67e564c428de8eb387ec56e086d7ff4dea784b6aa1c68b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 115840
  2⤵
  - Program crash
  PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 116632
  2⤵
  - Program crash
  PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3552 -ip 3552
1⤵
PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3552 -ip 3552
1⤵
PID:2636