850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2023 07:23

Target

23ee744fa24aaada6ab0a81166c2f5466d29d502.exe
Size

477KB
MD5

447f1d5a645314beb0b1d6b0f2f5119f
SHA1

23ee744fa24aaada6ab0a81166c2f5466d29d502
SHA256

850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92
SHA512

2a4ed5f9a933ef0330c81672c17623143ee0c3693d6c56c85632c0bac2b7a8fb049bae0af904a1bd2a16db8ac338d78d0928e0edc7f5d866170d25c19407e752
SSDEEP

3072:N36LY3qIwBzFyIR+DSbhsR2OsHas+8yqB1LuiCx8V8rIiJzQvstptE8z0N:N36hWsHtlLv8EiFES0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2644 3464 WerFault.exe 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

23ee744fa24aaada6ab0a81166c2f5466d29d502.exe

description pid process

Token: SeDebugPrivilege 3464 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe

pid	pid_target	process	target process
2644	3464	WerFault.exe	23ee744fa24aaada6ab0a81166c2f5466d29d502.exe

description	pid	process
Token: SeDebugPrivilege	3464	23ee744fa24aaada6ab0a81166c2f5466d29d502.exe

C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe
"C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 1728
2⤵
- Program crash
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3464 -ip 3464
1⤵
PID:3500

memory/3464-132-0x0000000000480000-0x00000000004FC000-memory.dmp

Filesize
496KB

Download