bbf38b1880ee037302435376852431fa870f18b0fec8662a9d7739d1087381db

Analysis

max time kernel
118s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 11:22

Target

7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Size

1.2MB
MD5

7d9ee189fe6bcd4d1dc07ba570684e2b
SHA1

6edf87ee5c05417cc6eff2959231120c3e1b6264
SHA256

5d1faea42a7bbcb40b0b2375becedbd9cfe5fe11c5497a76282d059553682dd3
SHA512

e7103b0804545be69a920015048853293904d289399fa0bb4509c63491a9968f4a225d944cc9b1453d4a4eb29d5184d7417a9f8ac2bd4f7ae9f6e4b8d38d0cba
SSDEEP

24576:FIky4/3X2JcF2jYAF5e2O+f4GC0Nnve511GAsu0Y09OJ+:G4PYOz3fJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2616 1404 WerFault.exe 7d9ee189fe6bcd4d1dc07ba570684e2b.exe

pid	pid_target	process	target process
2616	1404	WerFault.exe	7d9ee189fe6bcd4d1dc07ba570684e2b.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

7d9ee189fe6bcd4d1dc07ba570684e2b.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeSecurityPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeTakeOwnershipPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeLoadDriverPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeSystemProfilePrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeSystemtimePrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeProfSingleProcessPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeIncBasePriorityPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeCreatePagefilePrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeBackupPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeRestorePrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeShutdownPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeDebugPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeSystemEnvironmentPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeRemoteShutdownPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeUndockPrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: SeManageVolumePrivilege	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: 33	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: 34	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: 35	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe
Token: 36	1404	7d9ee189fe6bcd4d1dc07ba570684e2b.exe

C:\Users\Admin\AppData\Local\Temp\7d9ee189fe6bcd4d1dc07ba570684e2b.exe
"C:\Users\Admin\AppData\Local\Temp\7d9ee189fe6bcd4d1dc07ba570684e2b.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1404 -s 1108
2⤵
- Program crash
PID:2616

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 1404 -ip 1404
1⤵
PID:984

memory/1404-133-0x000002431EA70000-0x000002431EA91000-memory.dmp

Filesize
132KB

Download
memory/1404-134-0x0000024320640000-0x0000024320650000-memory.dmp

Filesize
64KB

Download
memory/1404-135-0x0000024320640000-0x0000024320650000-memory.dmp

Filesize
64KB

Download