1509db56062fad0a68c96aa84caaac90240b9235e180263f4876af1113d5d506

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 16:25

Target

KEY FRP TOOL V1.1/KEY FRP TOOL V1.1.exe
Size

3.6MB
MD5

5e60732ee1e5e05f3f217e0eab2c40c7
SHA1

837c22b654d7ec99acc4538b05f2f9cacfdfea2b
SHA256

911760b1c3ef15303e4c27ff1d20bec157e5c4e724d8b87c8fc9b0d2e4ec79bf
SHA512

95aefec2cd9e0cf5992bb2059bac1188436969a4e30c44b79fea50c55adf61d7969df7906f0df7b88bf2af5bf463ce5456d7f9087f36d0dfc4319a0f800b118e
SSDEEP

49152:3USzUm0XSN5EasMTL/TTQ8gWYDnLISIGEBpZ2TIup1vGvHPeJkVg9hYjB1L0:3USYm0jas8/wZWKnLISWpKRGnP4sX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	4416	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	KEY FRP TOOL V1.1.exe

C:\Users\Admin\AppData\Local\Temp\KEY FRP TOOL V1.1\KEY FRP TOOL V1.1.exe
"C:\Users\Admin\AppData\Local\Temp\KEY FRP TOOL V1.1\KEY FRP TOOL V1.1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 1016
  2⤵
  - Program crash
  PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4416 -ip 4416
1⤵
PID:3088

memory/4416-1-0x0000000000890000-0x0000000000C2A000-memory.dmp

Filesize
3.6MB

Download
memory/4416-0-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/4416-2-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/4416-3-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download