2a8dad48d4a81e1752e71f2f37a53a0ba4625f42bcea193b1783ac2c8f8e308c

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2023 11:40

Target

Refrence Order.exe
Size

22KB
MD5

bb639f8c81d9cf4a49e72015d7c75735
SHA1

91d717df3b5a1b833a60b5e2eb4d8f1c10555c62
SHA256

24c162c82ab104894354b4869e0f44ca289ae06b535827a7aefc08982effd2c9
SHA512

59b7137c0ef51746057b5dfd8ff09168a63e120898711914e7acb67393c109808ec73b77a56265de74b48e11ddc8ab4a81115e9c9435ebe019ec2a48eedad7f1
SSDEEP

384:TPHG946aVb9BezNZUG9bxcJ4SKKpK+dwQQC9EOAtFgyl8j3Bl//9NKa2HovbzOvp:jvV5vfDJHjRj3BxVTWJ1w3tXqSK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4420	4852	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	Refrence Order.exe

C:\Users\Admin\AppData\Local\Temp\Refrence Order.exe
"C:\Users\Admin\AppData\Local\Temp\Refrence Order.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4852 -s 1380
  2⤵
  - Program crash
  PID:4420

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 4852 -ip 4852
1⤵
PID:1368

memory/4852-133-0x000001EB65130000-0x000001EB6513A000-memory.dmp

Filesize
40KB

Download
memory/4852-134-0x000001EB00000000-0x000001EB00528000-memory.dmp

Filesize
5.2MB

Download
memory/4852-135-0x000001EB7F750000-0x000001EB7F760000-memory.dmp

Filesize
64KB

Download
memory/4852-136-0x000001EB7F750000-0x000001EB7F760000-memory.dmp

Filesize
64KB

Download