a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 11:26

Target

a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe
Size

7.8MB
MD5

2736a2e0257926a61a823a2eb2fb7c01
SHA1

22b8df0eba932276ab1ae3f0f8b25510c7693640
SHA256

a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b
SHA512

bb5c7c4dc8b58435b83fe1da8e56192d084f11af76a58a9808a8f96435d5f8d27ec538b2102c5cd17edfa5a4d2493887910b5cee3e9f22b63b0de3755f2a8da7
SSDEEP

98304:ODk6xf0gpZwGlbpJdUc2+e9CQNHNHMR3mUy1lbu4W6DX2y7QMsmWZiXrjHpngAzX:2YqbpJac2+QB3RjmytbvpDUjoXb1BJV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3840	3240	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3240	a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe
3240	a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3240	a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe
3240	a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe

C:\Users\Admin\AppData\Local\Temp\a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe
"C:\Users\Admin\AppData\Local\Temp\a7f7d84ebd2686f334773baafdc02f8c81e8d4311bfff0ff9ffb86baa453905b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 624
  2⤵
  - Program crash
  PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 3240
1⤵
PID:2164