f36fcfa679d010ecff1b23b6a8a8f9d081e92b63e6199485e7533229d4577123

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2024 02:41

Target

5bec31e59c3ea26cfac855f4874b3df1.exe
Size

629KB
MD5

5bec31e59c3ea26cfac855f4874b3df1
SHA1

8dcb5d10025b89939111d0f1b89f63adecae4cfa
SHA256

f36fcfa679d010ecff1b23b6a8a8f9d081e92b63e6199485e7533229d4577123
SHA512

cdeaf64023307bc24bbff38f6ce6da99b6ff316cffc04a8eabdb76be2b7e5f47f47305c22bffe94e97b7cd46ce3c866ca29129432b07ab22e85bee6eea867d68
SSDEEP

12288:tVt+w8wyv/266WoJfQLvy3QviTzLJ6p4Yz75mvFNv6wYs17ODK73dM:7t+w5yGDJfuvyRsVzVuHYi7ODAW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	4416	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4416	5bec31e59c3ea26cfac855f4874b3df1.exe

C:\Users\Admin\AppData\Local\Temp\5bec31e59c3ea26cfac855f4874b3df1.exe
"C:\Users\Admin\AppData\Local\Temp\5bec31e59c3ea26cfac855f4874b3df1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 328
  2⤵
  - Program crash
  PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 4416
1⤵
PID:808

memory/4416-0-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/4416-1-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/4416-3-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download
memory/4416-4-0x0000000000400000-0x0000000000550000-memory.dmp

Filesize
1.3MB

Download