5cf5ad9bf98403ff952bb9d2f23982a4dce7bb6991b990d93bf4febe047f5ce3

Analysis

max time kernel
146s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 04:25

Target

53f5db0c71adc81ed76f6f1c97d5cc66.exe
Size

31KB
MD5

53f5db0c71adc81ed76f6f1c97d5cc66
SHA1

26c3da9a009680c7741f347fc603b7987805bf20
SHA256

5cf5ad9bf98403ff952bb9d2f23982a4dce7bb6991b990d93bf4febe047f5ce3
SHA512

d0bc8545f234960d30ebfa95459170a5bf4c2a7de3a8dc355fd85679e7ff04da856e8e27873dc0469aedb1bbf8881ac842b1b6c4adaba714de8ea64b02b430a3
SSDEEP

768:jG9ZaUcYsCbp6C9xRh+RUA65eVdljKanbcuyD7U5ue:Sfo4bLRhIUN5eVHpnouy88e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	4948	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4948	53f5db0c71adc81ed76f6f1c97d5cc66.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	53f5db0c71adc81ed76f6f1c97d5cc66.exe

C:\Users\Admin\AppData\Local\Temp\53f5db0c71adc81ed76f6f1c97d5cc66.exe
"C:\Users\Admin\AppData\Local\Temp\53f5db0c71adc81ed76f6f1c97d5cc66.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 292
  2⤵
  - Program crash
  PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4948 -ip 4948
1⤵
PID:4416

memory/4948-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4948-1-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download