52cb2900fe999cec1e659ab3aff583d028553a2be2d2b1be6ebc0cca22a5df86

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 18:30

Target

FSE2.exe
Size

50KB
MD5

3edc1fc459ea2dc098722261ec3fbe05
SHA1

8fbb8efa0a3ba27d29a184a4b182ff537f82c9a8
SHA256

89f3cdd4c1e20eeac4d39fa709d40e8f3ebd8985a0a76673a44cf117eeeb458b
SHA512

a6cf1c104f8dece689cd21f7d65d510f07e86d25600f42d61838a664fbf640ead66fe4523499a38f37951faa3028bd469ad8f483287f986218f8cbfb50f3256d
SSDEEP

768:PhiPG/q1nVY2kh5yGJMwCH8Ufrg04g0rTpEIkGAwd:pzonVXkhVJMwCH5frgiMd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

932 1428 WerFault.exe FSE2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FSE2.exe

description pid process

Token: SeDebugPrivilege 1428 FSE2.exe

pid	pid_target	process	target process
932	1428	WerFault.exe	FSE2.exe

description	pid	process
Token: SeDebugPrivilege	1428	FSE2.exe

C:\Users\Admin\AppData\Local\Temp\FSE2.exe
"C:\Users\Admin\AppData\Local\Temp\FSE2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 2284
2⤵
- Program crash
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1428 -ip 1428
1⤵
PID:3608

memory/1428-0-0x0000000000FD0000-0x0000000000FE2000-memory.dmp

Filesize
72KB

Download
memory/1428-1-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1428-2-0x0000000006200000-0x00000000067A4000-memory.dmp

Filesize
5.6MB

Download
memory/1428-3-0x00000000059E0000-0x0000000005A72000-memory.dmp

Filesize
584KB

Download
memory/1428-4-0x0000000005C50000-0x0000000005DC6000-memory.dmp

Filesize
1.5MB

Download
memory/1428-5-0x0000000005BF0000-0x0000000005BFC000-memory.dmp

Filesize
48KB

Download
memory/1428-6-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/1428-7-0x0000000005C40000-0x0000000005C50000-memory.dmp

Filesize
64KB

Download
memory/1428-8-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download