5e7007c8b9ec598b2f5857ac42ee29ace9be0f36d4dc8eb3bb717bf1e8fd243e

Analysis

max time kernel
169s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 13:20

Target

5e7007c8b9ec598b2f5857ac42ee29ace9be0f36d4dc8eb3bb717bf1e8fd243e.exe
Size

971KB
MD5

e676314d048560de383ebacc298c520b
SHA1

2e8e2bac54dc89cadaea45f71e25f8c4efbc3d29
SHA256

5e7007c8b9ec598b2f5857ac42ee29ace9be0f36d4dc8eb3bb717bf1e8fd243e
SHA512

9df61a40b0276ef60fee3efdb9cfa81066db2c0001fc6593c2256184a5e0ff5504a53bee410be0546b4c4becabd83c16b01b3607f3e031330cc532118cb49071
SSDEEP

12288:wJBjHim3FqJ4gFouffjSy6UpP52VcW51nI:wJBjv3OFouffjSy6UpR2VcW5

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
644	820	WerFault.exe	85
2104	820	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	5e7007c8b9ec598b2f5857ac42ee29ace9be0f36d4dc8eb3bb717bf1e8fd243e.exe

C:\Users\Admin\AppData\Local\Temp\5e7007c8b9ec598b2f5857ac42ee29ace9be0f36d4dc8eb3bb717bf1e8fd243e.exe
"C:\Users\Admin\AppData\Local\Temp\5e7007c8b9ec598b2f5857ac42ee29ace9be0f36d4dc8eb3bb717bf1e8fd243e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 1652
  2⤵
  - Program crash
  PID:644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 1460
  2⤵
  - Program crash
  PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 820 -ip 820
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 820 -ip 820
1⤵
PID:1736

memory/820-0-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/820-1-0x0000000000740000-0x0000000000838000-memory.dmp

Filesize
992KB

Download
memory/820-2-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download
memory/820-3-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/820-4-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/820-5-0x00000000752E0000-0x0000000075A90000-memory.dmp

Filesize
7.7MB

Download