a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 08:53

Target

a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe
Size

1.0MB
MD5

340aaab1d32bc2409278b782e96f713e
SHA1

d92e26033ff43ce824e26931456b51919da37da0
SHA256

a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e
SHA512

c6d1d01defcde6bb5f14b1237a5bf70977878e9cad105dfca054789394670dc15c87870204d4476726d85836b0866e22af74807ad06148e7cc1c52c1f27034bc
SSDEEP

12288:zxByBgpGoPGJew8t2HQNA+2eD/jwbn4c6Kha7Ut5e/dkCnVj53XPDljXVvlG:LyB309i8n7jw9UO5e/dkQ3w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4820	4456	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4456	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe

C:\Users\Admin\AppData\Local\Temp\a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe
"C:\Users\Admin\AppData\Local\Temp\a7dad2a71887a18218cb79c6ce01365ced88886f695b5b8f857c159211e3767e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 1996
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4456 -ip 4456
1⤵
PID:3756

memory/4456-1-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/4456-0-0x0000000000FB0000-0x00000000010BC000-memory.dmp

Filesize
1.0MB

Download
memory/4456-5-0x00000000083B0000-0x0000000008954000-memory.dmp

Filesize
5.6MB

Download
memory/4456-6-0x0000000007E00000-0x0000000007E92000-memory.dmp

Filesize
584KB

Download
memory/4456-8-0x0000000007F60000-0x0000000007F70000-memory.dmp

Filesize
64KB

Download
memory/4456-7-0x0000000007EA0000-0x0000000007F06000-memory.dmp

Filesize
408KB

Download
memory/4456-9-0x0000000008C70000-0x0000000008C7A000-memory.dmp

Filesize
40KB

Download
memory/4456-10-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download