ce3fdb19b943eb7b17c1c744a5ae71688e011a98e4194ef316c3f610155b58a0

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 11:31

Target

14cd0d1de3560149ae96b6ca97141331.exe
Size

333KB
MD5

14cd0d1de3560149ae96b6ca97141331
SHA1

1fc626e3868c25eef2ae8462cbe24d1b596fd796
SHA256

ce3fdb19b943eb7b17c1c744a5ae71688e011a98e4194ef316c3f610155b58a0
SHA512

c4d0bba07efa385109815f9eb3dafbdc5d184a37f3614d61824bc325426a2eeb26861208d749ac6940ddfcca1dac25ce68dd57db7b35186003befba63a3acc47
SSDEEP

6144:Om6UslM9lJh/67b6fMMo6keEZ/jUItRAQpomDnxXV+WaytQbmjdJPpbIYzDYKoH:OmDslqNoYUrmQjDVBT1Lk

Score

4^/10

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\adobe\acrotray .exe	14cd0d1de3560149ae96b6ca97141331.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	14cd0d1de3560149ae96b6ca97141331.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	14cd0d1de3560149ae96b6ca97141331.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5104	4036	WerFault.exe	63

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4036	14cd0d1de3560149ae96b6ca97141331.exe
4036	14cd0d1de3560149ae96b6ca97141331.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	14cd0d1de3560149ae96b6ca97141331.exe

C:\Users\Admin\AppData\Local\Temp\14cd0d1de3560149ae96b6ca97141331.exe
"C:\Users\Admin\AppData\Local\Temp\14cd0d1de3560149ae96b6ca97141331.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 664
  2⤵
  - Program crash
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4036 -ip 4036
1⤵
PID:1012

memory/4036-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download