177961a533ecdae6533b3d8e3ee92243fca8e81c7490f739b005ff1b9e6e0b95

Analysis

max time kernel
145s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 14:18

Target

75887ef232cf91499b1fdda50081f8820203588e7aa4e59759bd25c1534815b2.exe
Size

2.9MB
MD5

adfa82573f0b19a4cee9b627e40801a6
SHA1

ce8f5c549432d9de0605843c23c6012e55a5ea93
SHA256

75887ef232cf91499b1fdda50081f8820203588e7aa4e59759bd25c1534815b2
SHA512

52bc4dd10f614ca63e040053964168e6ed4293cf38d8841c8bae487b8c2cb988f8d970cf9692d44c05dd60f392b627bd7e42b3ae33831b9d39bf0a5ece61d631
SSDEEP

49152:w7OntU7dLEm957rRhYh8M7HMZqknsgmTWoI99rL9m++ZdjtoyS41DvbEnPAj8Xr/:w7OntMdLPXpI+nsgmTWo+hMdjtEAC7/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4372	3160	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3160	75887ef232cf91499b1fdda50081f8820203588e7aa4e59759bd25c1534815b2.exe
Token: SeIncBasePriorityPrivilege	3160	75887ef232cf91499b1fdda50081f8820203588e7aa4e59759bd25c1534815b2.exe

C:\Users\Admin\AppData\Local\Temp\75887ef232cf91499b1fdda50081f8820203588e7aa4e59759bd25c1534815b2.exe
"C:\Users\Admin\AppData\Local\Temp\75887ef232cf91499b1fdda50081f8820203588e7aa4e59759bd25c1534815b2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1160
  2⤵
  - Program crash
  PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3160 -ip 3160
1⤵
PID:1512

memory/3160-0-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-1-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-2-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-3-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-4-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-5-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-6-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-7-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/3160-10-0x0000000000400000-0x0000000000F14000-memory.dmp

Filesize
11.1MB

Download
memory/3160-11-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download