b437fae38685d44e8fd3c1aafb0fa4e3c0b2117003cc6a388d3b05a0ee021f8f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:25

Target

11db8976bf75156cebc74e5e37698013.exe
Size

8KB
MD5

11db8976bf75156cebc74e5e37698013
SHA1

6dbbe85320d49190382db260efa100612f88772f
SHA256

b437fae38685d44e8fd3c1aafb0fa4e3c0b2117003cc6a388d3b05a0ee021f8f
SHA512

c4bdabe0a43fc8fa9a49dc30e7ddb8b655a61b582136bbfdda6d9015a01202d1a91b32fc18cf5b72ac0618ac12a1d6e612f667245088f4119d95b4772e633ab4
SSDEEP

96:wjTVzdEQpXYgA/2vZHtbxilif8KhCF7TCFRCFRCFJCFHCFzCFsCF/TU84RzNt:wLp342vnbH+BULz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	1772	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	11db8976bf75156cebc74e5e37698013.exe

C:\Users\Admin\AppData\Local\Temp\11db8976bf75156cebc74e5e37698013.exe
"C:\Users\Admin\AppData\Local\Temp\11db8976bf75156cebc74e5e37698013.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 1676
  2⤵
  - Program crash
  PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1772 -ip 1772
1⤵
PID:4228

memory/1772-1-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1772-0-0x0000000000750000-0x0000000000758000-memory.dmp

Filesize
32KB

Download
memory/1772-2-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/1772-3-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download