144a51e62a55120cf3a521ea8354a8e64f0de0f9b5d03bbefd122d4014afcc2e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:10

Target

00183fa4837dab9aa4dbf648f6660774.exe
Size

8KB
MD5

00183fa4837dab9aa4dbf648f6660774
SHA1

a7a3f4b84aa793b0bd42b3ac6a2f8b5db4e73674
SHA256

144a51e62a55120cf3a521ea8354a8e64f0de0f9b5d03bbefd122d4014afcc2e
SHA512

89a14471ea931c95d2c251aae530f548a1501357c93866ce0788a506e8de30049f2736fe39318815182d5872bc1887165d9dcd1a6fdab71f3ff6ac82d1c5e18c
SSDEEP

96:VjTVzdERWjxqHLETmqZHzbxilif8KhCF7TCFRCFRCFJCFHCFzCFsCF/YRyU84Rzj:V8WVNmqFbH++4ULz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4516	2792	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	00183fa4837dab9aa4dbf648f6660774.exe

C:\Users\Admin\AppData\Local\Temp\00183fa4837dab9aa4dbf648f6660774.exe
"C:\Users\Admin\AppData\Local\Temp\00183fa4837dab9aa4dbf648f6660774.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 1676
  2⤵
  - Program crash
  PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2792 -ip 2792
1⤵
PID:4076

memory/2792-0-0x0000000000F80000-0x0000000000F88000-memory.dmp

Filesize
32KB

Download
memory/2792-1-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2792-2-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/2792-3-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download