dcc75a6d2cc0e700bc84d5de94c4a3949e111eff7eda1f47b91af49b1378d47a

Analysis

max time kernel
163s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 21:45

Target

dcc75a6d2cc0e700bc84d5de94c4a3949e111eff7eda1f47b91af49b1378d47a.exe
Size

1.0MB
MD5

fd3374be754f2da9678efe8e10cf69d1
SHA1

43666d0b7c5a32fa56997e2f465dcf94b62b9c15
SHA256

dcc75a6d2cc0e700bc84d5de94c4a3949e111eff7eda1f47b91af49b1378d47a
SHA512

10f1928cbb9db526fa8ff79e004f2df0419fe18204191e93d14313629cd9647f029663fc0e992d290e7c0ade46767d8ceb05903112f3b3963d81f33500a7a641
SSDEEP

12288:lgpIKzjhH2jzhCmGGYp8CA0PsR4tee5Kha7Ut5e/dkCnVj53XPDflsqVvM:lgBPsHIzxsMeeDO5e/dkQ3hs9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	700	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
700	dcc75a6d2cc0e700bc84d5de94c4a3949e111eff7eda1f47b91af49b1378d47a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	dcc75a6d2cc0e700bc84d5de94c4a3949e111eff7eda1f47b91af49b1378d47a.exe

C:\Users\Admin\AppData\Local\Temp\dcc75a6d2cc0e700bc84d5de94c4a3949e111eff7eda1f47b91af49b1378d47a.exe
"C:\Users\Admin\AppData\Local\Temp\dcc75a6d2cc0e700bc84d5de94c4a3949e111eff7eda1f47b91af49b1378d47a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 2020
  2⤵
  - Program crash
  PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 700 -ip 700
1⤵
PID:1056

memory/700-0-0x0000000075120000-0x00000000758D0000-memory.dmp

Filesize
7.7MB

Download
memory/700-1-0x0000000075120000-0x00000000758D0000-memory.dmp

Filesize
7.7MB

Download
memory/700-2-0x0000000000280000-0x000000000038C000-memory.dmp

Filesize
1.0MB

Download
memory/700-6-0x00000000079F0000-0x0000000007F94000-memory.dmp

Filesize
5.6MB

Download
memory/700-7-0x0000000005780000-0x0000000005812000-memory.dmp

Filesize
584KB

Download
memory/700-8-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/700-9-0x0000000007640000-0x00000000076A6000-memory.dmp

Filesize
408KB

Download
memory/700-10-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/700-11-0x0000000008100000-0x000000000810A000-memory.dmp

Filesize
40KB

Download
memory/700-12-0x0000000075120000-0x00000000758D0000-memory.dmp

Filesize
7.7MB

Download