b23cb04afe59fee16c95ef5d24a67cb493d4ea88b62f6996e54493548acad6c2

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 15:27

Target

6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
Size

58KB
MD5

c41858fceca5148ce899e350bf6b2651
SHA1

9a9961d05631c8345a1b8b9ea0b95063d946fb8e
SHA256

6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e
SHA512

2ecf0cf9753b521f1393a62d4d411e99924620086e315164ec1f30f30353eb99eaecfc610553e66bcecb091109e979798d5057db925c21263f74da7d7135a2d5
SSDEEP

768:xilH4hDEJbQpg4R+QokagvBexAb5BMX+nXVoVq3QXNTrsjTZD+UknIzyv3n6Ul4u:YqJEpeg4RXoMsu5tK90jTbknIsFo6

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4208	5092	WerFault.exe	6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
5108	5092	WerFault.exe	6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe

description pid process

Token: SeDebugPrivilege 5092 6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe

description	pid	process
Token: SeDebugPrivilege	5092	6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe

C:\Users\Admin\AppData\Local\Temp\6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe
"C:\Users\Admin\AppData\Local\Temp\6ea27a08617ed35f8340fcc9eda5ccd7316eed9b192e3a7efd4cd5e1b8a4fc7e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1972
2⤵
- Program crash
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1992
2⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5092 -ip 5092
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5092 -ip 5092
1⤵
PID:2996

memory/5092-0-0x0000000000F50000-0x0000000000F64000-memory.dmp

Filesize
80KB

Download
memory/5092-1-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-2-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/5092-3-0x0000000005A80000-0x0000000005A90000-memory.dmp

Filesize
64KB

Download
memory/5092-4-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download