5f397374dca8583a084034b2df639957fa34d2948f5ae17c058f5a4863c231ac

Analysis

max time kernel
167s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 01:57

Target

4af681a966839bfb794759ee9f773321.exe
Size

959KB
MD5

4af681a966839bfb794759ee9f773321
SHA1

a3c00356cb90d7ce114b51497e07029206986d8a
SHA256

5f397374dca8583a084034b2df639957fa34d2948f5ae17c058f5a4863c231ac
SHA512

f5c839afcb97095cc03a1219d60802f3682263dca4ac798a863d260f52fbab84f614ba6dd0132abe4a8078c95ebdc266756d0d663c8b4f680f32752c3322ca65
SSDEEP

12288:s0NwwQvN6h0jNCumngV2BrfPGeFx0d7+Ss9vVGppB85msez78MIOn+rqkJ/23ltN:s0mrN3NbtFo+N1tLuqI2PFGZr+Z5J

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
644	1972	WerFault.exe	87
3724	1972	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	4af681a966839bfb794759ee9f773321.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 644	1972	4af681a966839bfb794759ee9f773321.exe	103
PID 1972 wrote to memory of 644	1972	4af681a966839bfb794759ee9f773321.exe	103
PID 1972 wrote to memory of 644	1972	4af681a966839bfb794759ee9f773321.exe	103

C:\Users\Admin\AppData\Local\Temp\4af681a966839bfb794759ee9f773321.exe
"C:\Users\Admin\AppData\Local\Temp\4af681a966839bfb794759ee9f773321.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 133488
  2⤵
  - Program crash
  PID:644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 133488
  2⤵
  - Program crash
  PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1972 -ip 1972
1⤵
PID:764

memory/1972-0-0x0000000000880000-0x0000000000978000-memory.dmp

Filesize
992KB

Download
memory/1972-1-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/1972-2-0x0000000007E30000-0x00000000083D4000-memory.dmp

Filesize
5.6MB

Download
memory/1972-3-0x0000000007960000-0x00000000079F2000-memory.dmp

Filesize
584KB

Download
memory/1972-4-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

Filesize
64KB

Download
memory/1972-5-0x0000000007A10000-0x0000000007A1A000-memory.dmp

Filesize
40KB

Download
memory/1972-6-0x0000000004DA0000-0x0000000004DA8000-memory.dmp

Filesize
32KB

Download
memory/1972-7-0x0000000008D60000-0x0000000008DFC000-memory.dmp

Filesize
624KB

Download
memory/1972-8-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download
memory/1972-9-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

Filesize
64KB

Download
memory/1972-10-0x0000000074920000-0x00000000750D0000-memory.dmp

Filesize
7.7MB

Download