6abcd9fb461fa338bf4019afe56fdb6bf2e645db0f1749ed3e158533f5676829

Analysis

max time kernel
61s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 10:27

Target

0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe
Size

1.9MB
MD5

56591e392123df2b09aaa9831d38a4d4
SHA1

3b05874b950d71eeda9eb3a59b74f821013ad70a
SHA256

0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956
SHA512

55b090b09672333d589200e05379e516d9fea4b32da02369da0386b01f735803cb915bf4278c68091d993a55b3c2d5535b7abb5e7720e1ec5513ebd01693a413
SSDEEP

12288:yxWcZoObfOS+9YGsJwAl01c3l1+RobUCmf2bx3zBX3yF+EKFhDzP3UZ9xE9jKB3y:WfDdGsJm1OVmfihmevP3r9jKB3nwPg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1824	2436	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe

C:\Users\Admin\AppData\Local\Temp\0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe
"C:\Users\Admin\AppData\Local\Temp\0fe03b44fa49da56d112ac738bdb443b836e433101992d7b53eda3bb9d056956.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2436 -s 1380
  2⤵
  - Program crash
  PID:1824

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 2436 -ip 2436
1⤵
PID:1584

memory/2436-133-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2436-134-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/2436-135-0x0000000002A10000-0x0000000002A4C000-memory.dmp

Filesize
240KB

Download
memory/2436-136-0x000000001C190000-0x000000001C1A0000-memory.dmp

Filesize
64KB

Download
memory/2436-137-0x000000001C190000-0x000000001C1A0000-memory.dmp

Filesize
64KB

Download