1aabc291b910d51719c3f0fe074f4f284c160796d10d4d2a46acb3c64239449e

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 12:36

Target

25367c955449f48ffc7fd421f8a5f822.exe
Size

987KB
MD5

25367c955449f48ffc7fd421f8a5f822
SHA1

ea39dd8a123d8ffa664e2d91f8f27dfa27f8351b
SHA256

29cd7bf1c70867fc4c7b751e86dcc2d5543b23d92284c8421c829e33ca1589bf
SHA512

b928a8b8bf1207137b9d1f22ae6848fcaeccffdc8c0f0493250761265a4074a511429dd2599ee6a00e867ca1c78df79c25b33c840fda9df32fea1aefdc51b115
SSDEEP

12288:zkgmEQG1G/tf4LOL9FCgppwTz0v/rqQ9ABdMZmJdhIy1VqloXU/KM01EnFrVYlxd:FshEA9udx5u/nFuaakm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	4544	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	25367c955449f48ffc7fd421f8a5f822.exe

C:\Users\Admin\AppData\Local\Temp\25367c955449f48ffc7fd421f8a5f822.exe
"C:\Users\Admin\AppData\Local\Temp\25367c955449f48ffc7fd421f8a5f822.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1964
  2⤵
  - Program crash
  PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4544 -ip 4544
1⤵
PID:5068

memory/4544-1-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/4544-0-0x00000000006D0000-0x00000000007CC000-memory.dmp

Filesize
1008KB

Download
memory/4544-2-0x0000000002B50000-0x0000000002B60000-memory.dmp

Filesize
64KB

Download
memory/4544-3-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download