00ef3596374047bd214a87926b7b462301f5c3e4bd5d976ca122688951a0b2f2

Analysis

max time kernel
129s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230824-en
resource tags

arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 09:04

Target

SineeDriver-英文可执行文件(EM760)/SineeDriver-英文可执行文件(EM760)/SineeDriver_EN/Car.exe
Size

5.9MB
MD5

ceb803903878885cf196976ec8f9283a
SHA1

f2293478dac8cd6bdfc7b7045bfb378744f94f63
SHA256

156e1b595101685ed71cf2d05a42a7af64a5bc060cd015fbc6c083a5dc83e2c5
SHA512

234af28360e74b2b7decb31ba262cbad29f917c092e3b22904523acd30bc231ea349ba54efc26ed2d90437a1ab1330331113a142aee21800502add8a708d89f2
SSDEEP

98304:80egrtJq5fiaRnPcoDobkbVGaDhpVzAbLr5TrIpQpYRFCVNXxf7aUIy:80egq5fio/DC6BEb35TrIpwKid7hI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	4084	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	Car.exe

C:\Users\Admin\AppData\Local\Temp\SineeDriver-英文可执行文件(EM760)\SineeDriver-英文可执行文件(EM760)\SineeDriver_EN\Car.exe
"C:\Users\Admin\AppData\Local\Temp\SineeDriver-英文可执行文件(EM760)\SineeDriver-英文可执行文件(EM760)\SineeDriver_EN\Car.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1148
  2⤵
  - Program crash
  PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4084 -ip 4084
1⤵
PID:4728

memory/4084-0-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/4084-1-0x0000000000F30000-0x0000000001524000-memory.dmp

Filesize
6.0MB

Download
memory/4084-2-0x0000000005F60000-0x0000000005F70000-memory.dmp

Filesize
64KB

Download
memory/4084-3-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

Filesize
4KB

Download
memory/4084-4-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download
memory/4084-5-0x0000000005F60000-0x0000000005F70000-memory.dmp

Filesize
64KB

Download
memory/4084-6-0x0000000075280000-0x0000000075A30000-memory.dmp

Filesize
7.7MB

Download