f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd

Analysis

max time kernel
136s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2023 13:37

Target

03c3f979feffbf02e7ab9a66f9a1f7b4.exe
Size

12KB
MD5

03c3f979feffbf02e7ab9a66f9a1f7b4
SHA1

826e5038b32c3975821eb8641e484b575fdfa7e9
SHA256

f746b0a6d47ddc6b6a03d78a7dca6e61bbb32a35cdf89073cd245eb4662cfbfd
SHA512

14451960a5e111d44d58e0660a0d5f1dfcae74046fd595d6e8f758c0d01181141201af0813425e571f2296b9cab2ed314ac2a65d1ba139d4deaf6180b5e9a8ea
SSDEEP

192:wMJ0X7yZWu7s3+7DBPSVcWF28A6lJGNyQK+NAA5yQ03826p:wvLygTO7D4qWF28bJHQllm6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3344 2764 WerFault.exe 03c3f979feffbf02e7ab9a66f9a1f7b4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

03c3f979feffbf02e7ab9a66f9a1f7b4.exe

description pid process

Token: SeDebugPrivilege 2764 03c3f979feffbf02e7ab9a66f9a1f7b4.exe

pid	pid_target	process	target process
3344	2764	WerFault.exe	03c3f979feffbf02e7ab9a66f9a1f7b4.exe

description	pid	process
Token: SeDebugPrivilege	2764	03c3f979feffbf02e7ab9a66f9a1f7b4.exe

C:\Users\Admin\AppData\Local\Temp\03c3f979feffbf02e7ab9a66f9a1f7b4.exe
"C:\Users\Admin\AppData\Local\Temp\03c3f979feffbf02e7ab9a66f9a1f7b4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 1460
2⤵
- Program crash
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2764 -ip 2764
1⤵
PID:916

memory/2764-133-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/2764-134-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/2764-135-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download