136effc31a4fd394d73bc1bd1be399d428bf841799a1e832c7fd0e987cac0c59

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:07

Target

1c7e5ab05a83a502ce67ea2675d86cc3.exe
Size

32KB
MD5

1c7e5ab05a83a502ce67ea2675d86cc3
SHA1

37f5595d414020cdced8db8851ed32a20437a947
SHA256

136effc31a4fd394d73bc1bd1be399d428bf841799a1e832c7fd0e987cac0c59
SHA512

712fa9ee73b194c38e1a2c6e3514521e88a2d4f6c629b7b38d12d99f4c5f86343f191bfcad6149a3877b4383e1905dcac92b8f136ea5419465fd57de7872ed03
SSDEEP

768:XEAFJsK0b1Z5HFsKRId8zlR2QWyMQ6+zdHeNFK:XXEzJFsKRIdasvgx+G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3156	4820	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4820	1c7e5ab05a83a502ce67ea2675d86cc3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	1c7e5ab05a83a502ce67ea2675d86cc3.exe

C:\Users\Admin\AppData\Local\Temp\1c7e5ab05a83a502ce67ea2675d86cc3.exe
"C:\Users\Admin\AppData\Local\Temp\1c7e5ab05a83a502ce67ea2675d86cc3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1232
  2⤵
  - Program crash
  PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4820 -ip 4820
1⤵
PID:4220

memory/4820-0-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4820-1-0x00000000009F0000-0x00000000009FE000-memory.dmp

Filesize
56KB

Download
memory/4820-2-0x0000000007800000-0x0000000007810000-memory.dmp

Filesize
64KB

Download
memory/4820-3-0x0000000007E80000-0x0000000007EE6000-memory.dmp

Filesize
408KB

Download
memory/4820-4-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download