de61d719b3b98fc6ec86e70baaa7cbb53a57aa1f7b4cc30783762f33dd589835

Analysis

max time kernel
160s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 03:11

Target

7865bd1702a8060b9f1c48a325560d2b8f947604e000022eb34637348e063ac6.exe
Size

1.5MB
MD5

642e026b63c293599ac50d11fddf9c75
SHA1

be43c71c4438affd55510068c822bf837a64b820
SHA256

7865bd1702a8060b9f1c48a325560d2b8f947604e000022eb34637348e063ac6
SHA512

bc18dae9ffd36edefc56943e44be29cc72275fd5b6533de74f927d560ab4fccc52c74209a594d9b4fb058b9df9f3154127276cde771366bcc35d26935226d56e
SSDEEP

24576:Eqdm7rLpuhBb8rNTkOw7Dwj7mNrIDza1O2QfQWav:tm4H86NnDO2QfQX

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1068	1380	WerFault.exe	85
8	1380	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1380	7865bd1702a8060b9f1c48a325560d2b8f947604e000022eb34637348e063ac6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	7865bd1702a8060b9f1c48a325560d2b8f947604e000022eb34637348e063ac6.exe

C:\Users\Admin\AppData\Local\Temp\7865bd1702a8060b9f1c48a325560d2b8f947604e000022eb34637348e063ac6.exe
"C:\Users\Admin\AppData\Local\Temp\7865bd1702a8060b9f1c48a325560d2b8f947604e000022eb34637348e063ac6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 1968
  2⤵
  - Program crash
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 1968
  2⤵
  - Program crash
  PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1380 -ip 1380
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1380 -ip 1380
1⤵
PID:1976

memory/1380-0-0x0000000000DD0000-0x0000000000F4C000-memory.dmp

Filesize
1.5MB

Download
memory/1380-1-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download
memory/1380-2-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/1380-3-0x0000000005850000-0x0000000005858000-memory.dmp

Filesize
32KB

Download
memory/1380-4-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download
memory/1380-5-0x0000000005920000-0x0000000005930000-memory.dmp

Filesize
64KB

Download
memory/1380-6-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download