07a72d61154c37817fbb112e37e8a108886857d588c3df46cce7d84d92ca8ec6

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2023 19:11

Target

0e67384a4b89fb49f8f007af35122955cbf1d310.exe
Size

7KB
MD5

872ee416b911925c61ddd11d2f3eeb7b
SHA1

0e67384a4b89fb49f8f007af35122955cbf1d310
SHA256

07a72d61154c37817fbb112e37e8a108886857d588c3df46cce7d84d92ca8ec6
SHA512

bb61899323d423147724ab9556006791452ae0d27c73c0fd07f1b4882c06f96001d7db154bab6e479c75137bf112656b9a79de499e79ddb189b982663f8e7977
SSDEEP

96:BG+1jsTi+wX7GEmPbnfK6IoP8ZY7ZMt5vdQ6k2CttLzNt:BG+eW+wXC9bfXPgGHf3N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3884	4988	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	0e67384a4b89fb49f8f007af35122955cbf1d310.exe

C:\Users\Admin\AppData\Local\Temp\0e67384a4b89fb49f8f007af35122955cbf1d310.exe
"C:\Users\Admin\AppData\Local\Temp\0e67384a4b89fb49f8f007af35122955cbf1d310.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 1756
  2⤵
  - Program crash
  PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4988 -ip 4988
1⤵
PID:3472

memory/4988-132-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download