f00982603a693995cf32649df28ac390ce839638751f04d11517454466061785

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2023 07:17

Target

7034c12131cc2e28fcf9235850a36b08e9983dce.exe
Size

7KB
MD5

1c72fb093ace75fffb093c6541ff4940
SHA1

7034c12131cc2e28fcf9235850a36b08e9983dce
SHA256

f00982603a693995cf32649df28ac390ce839638751f04d11517454466061785
SHA512

4d713c85e2b5a818e3f5db4c7b59a820bb309c911825670b540597c9faa9d931f5648d054e19a01a48f7c97bae6dfe67b02148fb3ad58ddafdd11bb06f8a59ed
SSDEEP

96:lTlsnKYgr+QLZCMqm18WQ2juY+wq+Df/8tEkajtR/zNt:lpQELZCMqmXjuZ+z8zaj7p

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 4644 WerFault.exe 7034c12131cc2e28fcf9235850a36b08e9983dce.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7034c12131cc2e28fcf9235850a36b08e9983dce.exe

description pid process

Token: SeDebugPrivilege 4644 7034c12131cc2e28fcf9235850a36b08e9983dce.exe

pid	pid_target	process	target process
1356	4644	WerFault.exe	7034c12131cc2e28fcf9235850a36b08e9983dce.exe

description	pid	process
Token: SeDebugPrivilege	4644	7034c12131cc2e28fcf9235850a36b08e9983dce.exe

C:\Users\Admin\AppData\Local\Temp\7034c12131cc2e28fcf9235850a36b08e9983dce.exe
"C:\Users\Admin\AppData\Local\Temp\7034c12131cc2e28fcf9235850a36b08e9983dce.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1692
  2⤵
  - Program crash
  PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4644 -ip 4644
1⤵
PID:3472

memory/4644-132-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

Filesize
32KB

Download