bbf38b1880ee037302435376852431fa870f18b0fec8662a9d7739d1087381db

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 11:22

Target

4da95447ef335d683699e9ba3f352797.exe
Size

1.2MB
MD5

4da95447ef335d683699e9ba3f352797
SHA1

8e15f95f54e72f619859284f637dc8a5312aa2d7
SHA256

de36087644980290e7ee80cadc86705230536ff8ad143542323086d5f0338d52
SHA512

9cc91ba7ba111e48efab962e71f2e4f8f704fee707f5cebd89d07a4066b4e06aff031f62c38ca7d6cf44a3aeaef22f750b042b6f354dff3a631a971de4b106e0
SSDEEP

24576:LIky4/3X2JcF2jYAF5e2O+f4GC0Nnve511GAsu0Y09OJH:84PYOz3fJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4948 1692 WerFault.exe 4da95447ef335d683699e9ba3f352797.exe

pid	pid_target	process	target process
4948	1692	WerFault.exe	4da95447ef335d683699e9ba3f352797.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

4da95447ef335d683699e9ba3f352797.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeSecurityPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeTakeOwnershipPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeLoadDriverPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeSystemProfilePrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeSystemtimePrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeProfSingleProcessPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeIncBasePriorityPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeCreatePagefilePrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeBackupPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeRestorePrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeShutdownPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeDebugPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeSystemEnvironmentPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeRemoteShutdownPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeUndockPrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: SeManageVolumePrivilege	1692	4da95447ef335d683699e9ba3f352797.exe
Token: 33	1692	4da95447ef335d683699e9ba3f352797.exe
Token: 34	1692	4da95447ef335d683699e9ba3f352797.exe
Token: 35	1692	4da95447ef335d683699e9ba3f352797.exe
Token: 36	1692	4da95447ef335d683699e9ba3f352797.exe

C:\Users\Admin\AppData\Local\Temp\4da95447ef335d683699e9ba3f352797.exe
"C:\Users\Admin\AppData\Local\Temp\4da95447ef335d683699e9ba3f352797.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1692 -s 1224
2⤵
- Program crash
PID:4948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 1692 -ip 1692
1⤵
PID:4032

memory/1692-133-0x00000173C1820000-0x00000173C1841000-memory.dmp

Filesize
132KB

Download
memory/1692-134-0x00000173C3230000-0x00000173C3240000-memory.dmp

Filesize
64KB

Download
memory/1692-135-0x00000173C3230000-0x00000173C3240000-memory.dmp

Filesize
64KB

Download
memory/1692-136-0x00000173C3230000-0x00000173C3240000-memory.dmp

Filesize
64KB

Download
memory/1692-137-0x00000173C3230000-0x00000173C3240000-memory.dmp

Filesize
64KB

Download
memory/1692-138-0x00000173C3230000-0x00000173C3240000-memory.dmp

Filesize
64KB

Download