8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9

Analysis

max time kernel
90s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2023 10:24

Target

8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe
Size

23KB
MD5

e1a97bd74d5c83743b0e19c58553cac0
SHA1

9241ad2697577e1c9846bda6893a8f0ab626b812
SHA256

8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9
SHA512

25e04e1993a251edb61209292e647c3bbeb8a831805cab83ffbc875c682b56ac9ca154b088b990eb7087aa95d070cf41a267860b74c1d42d6a84ecd5b353dc10
SSDEEP

384:/C/FEFHfBot6c3aCV+ivCUK0qIHJTI79O7GoX1DH:MiHuKa+dUKMpP7ZN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
932	1724	WerFault.exe	75

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe

C:\Users\Admin\AppData\Local\Temp\8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe
"C:\Users\Admin\AppData\Local\Temp\8a0d06a81396473b31f725951c85533ee89cc6d8400372d0e8caf7c2e5d004c9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1776
  2⤵
  - Program crash
  PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1724 -ip 1724
1⤵
PID:3448

memory/1724-132-0x0000000000040000-0x000000000004C000-memory.dmp

Filesize
48KB

Download
memory/1724-133-0x0000000004E20000-0x00000000053C4000-memory.dmp

Filesize
5.6MB

Download
memory/1724-134-0x0000000004910000-0x00000000049A2000-memory.dmp

Filesize
584KB

Download