d06d17c55bcfa13a61c0f519e655ae08a1303635e666c5b5206707b62acada0c

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 07:35

Target

2964-2-0x0000000000400000-0x0000000000486000-memory.exe
Size

536KB
MD5

94d23ca97b54ff119af4eacd2fd3d7b4
SHA1

a977664a28af6f5e53381da4ae88fe13518b67f0
SHA256

d06d17c55bcfa13a61c0f519e655ae08a1303635e666c5b5206707b62acada0c
SHA512

4597a8ea26bfd387d1a32acc9db30a5407fa77fd6134254c58cf1a77ba27c7d432fd5ce9f61089f0b8d2dd48d9cc6a83ffdf953aee8b13f5d92ec384c506fa0f
SSDEEP

6144:zu1FgDGJrF+64zIMHQRWsZA0DlgCx0Tk:aEKf+64NHqZAqlH8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2316 4632 WerFault.exe 2964-2-0x0000000000400000-0x0000000000486000-memory.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4632 svchost.exe

pid	pid_target	process	target process
2316	4632	WerFault.exe	2964-2-0x0000000000400000-0x0000000000486000-memory.exe

description	pid	process
Token: SeManageVolumePrivilege	4632	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2964-2-0x0000000000400000-0x0000000000486000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2964-2-0x0000000000400000-0x0000000000486000-memory.exe"
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 216
2⤵
- Program crash
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4632 -ip 4632
1⤵
PID:4380

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632

memory/4632-0-0x0000021700640000-0x0000021700650000-memory.dmp

Filesize
64KB

Download
memory/4632-16-0x0000021700740000-0x0000021700750000-memory.dmp

Filesize
64KB

Download
memory/4632-32-0x0000021708A20000-0x0000021708A21000-memory.dmp

Filesize
4KB

Download
memory/4632-34-0x0000021708A50000-0x0000021708A51000-memory.dmp

Filesize
4KB

Download
memory/4632-35-0x0000021708A50000-0x0000021708A51000-memory.dmp

Filesize
4KB

Download
memory/4632-36-0x0000021708B60000-0x0000021708B61000-memory.dmp

Filesize
4KB

Download