997e12ff13b6c5fa06d85b5c0bc4d1c26a53c74a6fd364b4ec499c41b978a08c

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 14:10

Target

7271ad16f74b8ec38dc683e50c05f296.exe
Size

74KB
MD5

7271ad16f74b8ec38dc683e50c05f296
SHA1

40850b93fb55672375ffabcb32d4952a31acd213
SHA256

997e12ff13b6c5fa06d85b5c0bc4d1c26a53c74a6fd364b4ec499c41b978a08c
SHA512

a23c903fdd15318de9f9eee48bfe258832ee00143c9b6da7ade0998291616536458fdf7b7efc88208bd2d67b7f2230d107af358b5f6105238d6e03203a215398
SSDEEP

192:Bn8L358rH+t+K3UgmOkbWEvec/5eWJeLBSSZRtoAUntgSE1:Bn8LJ8rHO73HkiEvec/psByAUntgS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	1308	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	7271ad16f74b8ec38dc683e50c05f296.exe

C:\Users\Admin\AppData\Local\Temp\7271ad16f74b8ec38dc683e50c05f296.exe
"C:\Users\Admin\AppData\Local\Temp\7271ad16f74b8ec38dc683e50c05f296.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1688
  2⤵
  - Program crash
  PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1308 -ip 1308
1⤵
PID:2092

memory/1308-0-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/1308-1-0x00000000002B0000-0x00000000002C8000-memory.dmp

Filesize
96KB

Download
memory/1308-2-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download
memory/1308-3-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download