e39b70eccdfa998c27b6522ccb42cc9869f60c131c99c4ce48e411c264bf8706

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 09:15

Target

744e81a561855c841c1d1b96e509fe01.exe
Size

8KB
MD5

744e81a561855c841c1d1b96e509fe01
SHA1

c117442f3ba16c421139df4aa8779c65fa760a32
SHA256

e39b70eccdfa998c27b6522ccb42cc9869f60c131c99c4ce48e411c264bf8706
SHA512

31a2e5ebf2bd9201e71986e7c31556b5251f98997dd117b7e119f1322a123e2211fba93c62984ecc7d45aea51dfe3d3f553b063dc64e94492b0d6a2a7d91f3d3
SSDEEP

96:QjTVzdEZt89ZHzBxilif8KhCF7TCFRCFRCFJCFHCFzCFsCF/yGfoVDUk4RzNt:QU6FBH+XoVDUDz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	540	WerFault.exe	54

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	744e81a561855c841c1d1b96e509fe01.exe

C:\Users\Admin\AppData\Local\Temp\744e81a561855c841c1d1b96e509fe01.exe
"C:\Users\Admin\AppData\Local\Temp\744e81a561855c841c1d1b96e509fe01.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 1668
  2⤵
  - Program crash
  PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 540 -ip 540
1⤵
PID:3204

memory/540-0-0x0000000000050000-0x0000000000058000-memory.dmp

Filesize
32KB

Download
memory/540-1-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download
memory/540-2-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/540-3-0x0000000074A90000-0x0000000075240000-memory.dmp

Filesize
7.7MB

Download