e01332a4fe4dccce77e4549ec280426162dc150181afb0529bd1fb405daa2bd8

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 22:23

Target

e01332a4fe4dccce77e4549ec280426162dc150181afb0529bd1fb405daa2bd8_JC.exe
Size

605KB
MD5

68bb8d7de9ce7ed8f7622204b2b9f9f5
SHA1

16e8bb79219cafb1e91ed3ba82aa847e773a00c5
SHA256

e01332a4fe4dccce77e4549ec280426162dc150181afb0529bd1fb405daa2bd8
SHA512

f211286250e6e07987c1584958dba398ae4be96f8ab92e976a7f6a820c651a0c81f86e707a6c4c5a4735967a6c9fb228c80bba3f7d06236be0148bf39e0612ee
SSDEEP

12288:LliSEH4VSLQLbSzi2zPif51HeMRz1nstBYqO:JiWrbSu6Y51HtnstBYqO

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4752	2484	WerFault.exe	83
2260	2484	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2484	e01332a4fe4dccce77e4549ec280426162dc150181afb0529bd1fb405daa2bd8_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	e01332a4fe4dccce77e4549ec280426162dc150181afb0529bd1fb405daa2bd8_JC.exe

C:\Users\Admin\AppData\Local\Temp\e01332a4fe4dccce77e4549ec280426162dc150181afb0529bd1fb405daa2bd8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e01332a4fe4dccce77e4549ec280426162dc150181afb0529bd1fb405daa2bd8_JC.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1932
  2⤵
  - Program crash
  PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1972
  2⤵
  - Program crash
  PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2484 -ip 2484
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2484 -ip 2484
1⤵
PID:3704

memory/2484-0-0x0000000000D60000-0x0000000000DFE000-memory.dmp

Filesize
632KB

Download
memory/2484-1-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download
memory/2484-2-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download
memory/2484-3-0x00000000056B0000-0x00000000056B8000-memory.dmp

Filesize
32KB

Download
memory/2484-4-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download
memory/2484-5-0x00000000056D0000-0x00000000056E0000-memory.dmp

Filesize
64KB

Download
memory/2484-6-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download