12f57b05eeab351d9bd7fc19891eb8c16763497cbd59314b15cf236f5ec15f7d

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 03:51

Target

aaef06a25acb7e6ddfab2def3a17574c.exe
Size

212KB
MD5

aaef06a25acb7e6ddfab2def3a17574c
SHA1

c5a24505350c3555303a504fae607af9e5cba6c6
SHA256

12f57b05eeab351d9bd7fc19891eb8c16763497cbd59314b15cf236f5ec15f7d
SHA512

5cbe8ba45c5cfb4be15f302c333cc0d8ff3229137240a6601f72fff9f7324885b712ac0704fda46da692d92d57cf9ea2a2ddb70f728c22ca8859dea4b66a237e
SSDEEP

3072:LzaFjdm1PRlA3Ud1sQSkLQ5HHhTtkxWgjq4J:aFp+PRya1hSkk5HHhTtkMgjq4J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	4416	WerFault.exe	87

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	aaef06a25acb7e6ddfab2def3a17574c.exe
Token: SeCreatePagefilePrivilege	4416	aaef06a25acb7e6ddfab2def3a17574c.exe
Token: SeShutdownPrivilege	4416	aaef06a25acb7e6ddfab2def3a17574c.exe
Token: SeCreatePagefilePrivilege	4416	aaef06a25acb7e6ddfab2def3a17574c.exe
Token: SeShutdownPrivilege	4416	aaef06a25acb7e6ddfab2def3a17574c.exe
Token: SeCreatePagefilePrivilege	4416	aaef06a25acb7e6ddfab2def3a17574c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4416	aaef06a25acb7e6ddfab2def3a17574c.exe

C:\Users\Admin\AppData\Local\Temp\aaef06a25acb7e6ddfab2def3a17574c.exe
"C:\Users\Admin\AppData\Local\Temp\aaef06a25acb7e6ddfab2def3a17574c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 464
  2⤵
  - Program crash
  PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4416 -ip 4416
1⤵
PID:824