dd55a058119bb606dbc3852eb540b3d674b373a78d4c0bc20d6f6fb3657fe9fd

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 03:56

Target

042e5d63d5a85c58007de6b0abce47ab.exe
Size

128KB
MD5

042e5d63d5a85c58007de6b0abce47ab
SHA1

4b8a0b6d35cc858ccbf21dac6b06d19cbec0fb31
SHA256

dd55a058119bb606dbc3852eb540b3d674b373a78d4c0bc20d6f6fb3657fe9fd
SHA512

4ab63cffdefc2bcf7208e3d727e903fefef2db10f32cff2ace7106426dd27912951214122580d2b20745b54755511883e992aca892d04c3d2f46dc54dba42373
SSDEEP

1536:BdquqmReDXI9XPE/otP89Uwnh/9J/ntBVRcZUZWxt4KT:BdquHaotE9VHJ/FRcyZmt4KT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3136	4080	WerFault.exe	39

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	4080	042e5d63d5a85c58007de6b0abce47ab.exe

C:\Users\Admin\AppData\Local\Temp\042e5d63d5a85c58007de6b0abce47ab.exe
"C:\Users\Admin\AppData\Local\Temp\042e5d63d5a85c58007de6b0abce47ab.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 328
  2⤵
  - Program crash
  PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 4080
1⤵
PID:808