d9ddeb59d000d9b84549d00c2cf119878d16111a1a77e34c3405a22118cb3101

Analysis

max time kernel
100s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 05:39

Target

d9ddeb59d000d9b84549d00c2cf119878d16111a1a77e34c3405a22118cb3101.exe
Size

131KB
MD5

5384b6fe276b939ad1796fb339657ae1
SHA1

642e06baada1f7a6b9dd03f1cc19329b3c768bed
SHA256

d9ddeb59d000d9b84549d00c2cf119878d16111a1a77e34c3405a22118cb3101
SHA512

1680be53185e7016f97e5591293671162938bb2a8e469582e29f89ee20186ad338268a7e40f080276536d8b3d52c64b6043d068f294242d369a44a6e08b94e19
SSDEEP

3072:H55dqWrrsum+psCFbSC7GmCMY7pdk5+rTIXAJ:HsQo0sCFOvXTqAJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5000	4720	WerFault.exe	69

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	d9ddeb59d000d9b84549d00c2cf119878d16111a1a77e34c3405a22118cb3101.exe

C:\Users\Admin\AppData\Local\Temp\d9ddeb59d000d9b84549d00c2cf119878d16111a1a77e34c3405a22118cb3101.exe
"C:\Users\Admin\AppData\Local\Temp\d9ddeb59d000d9b84549d00c2cf119878d16111a1a77e34c3405a22118cb3101.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 1768
  2⤵
  - Program crash
  PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4720 -ip 4720
1⤵
PID:2716

memory/4720-0-0x0000000000D40000-0x0000000000D64000-memory.dmp

Filesize
144KB

Download
memory/4720-1-0x0000000075210000-0x00000000759C0000-memory.dmp

Filesize
7.7MB

Download
memory/4720-2-0x0000000005730000-0x0000000005740000-memory.dmp

Filesize
64KB

Download
memory/4720-3-0x0000000075210000-0x00000000759C0000-memory.dmp

Filesize
7.7MB

Download