b9cb59244ae380b87c41822802fe472bbab263e701339ce83a3d3896fbbda8d2

Analysis

max time kernel
152s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:51

Target

19116e822e8178fc103e51fe18c825a4.exe
Size

34KB
MD5

19116e822e8178fc103e51fe18c825a4
SHA1

f590a8f1b2f337864b166d8ce53a53e77089135b
SHA256

b9cb59244ae380b87c41822802fe472bbab263e701339ce83a3d3896fbbda8d2
SHA512

3eff84d1dd5fd3fb162e25d2e8d7f3ccb12d408ec3cf18c9e644ca3a8b87b5a29e9c0a0726f929efb890fe8c9cff3a89709dc3f32a047ae1eda18296bd20c271
SSDEEP

768:fMjB/JpMfHDWqpuXDvod3UmQmv4acY2GS2C9xjwhU:UFQlpSDvoJrbvUfGS2q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	3356	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3356	19116e822e8178fc103e51fe18c825a4.exe

C:\Users\Admin\AppData\Local\Temp\19116e822e8178fc103e51fe18c825a4.exe
"C:\Users\Admin\AppData\Local\Temp\19116e822e8178fc103e51fe18c825a4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1536
  2⤵
  - Program crash
  PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3356 -ip 3356
1⤵
PID:3540

memory/3356-0-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download
memory/3356-1-0x0000000000740000-0x000000000074E000-memory.dmp

Filesize
56KB

Download
memory/3356-2-0x00000000050D0000-0x000000000516C000-memory.dmp

Filesize
624KB

Download
memory/3356-3-0x0000000005170000-0x00000000051E6000-memory.dmp

Filesize
472KB

Download
memory/3356-4-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/3356-5-0x0000000005D60000-0x0000000005D7E000-memory.dmp

Filesize
120KB

Download
memory/3356-7-0x0000000074450000-0x0000000074C00000-memory.dmp

Filesize
7.7MB

Download