ed579e51443a046ff49eb8bde112891d5f17e3c305c885c253360c5211ce3234

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 08:32

Target

ed579e51443a046ff49eb8bde112891d5f17e3c305c885c253360c5211ce3234.exe
Size

438KB
MD5

24ef4b5ac2066128ba7721e003f552b8
SHA1

10264d96bc62c2408e4b30e37b460f33b62df37d
SHA256

ed579e51443a046ff49eb8bde112891d5f17e3c305c885c253360c5211ce3234
SHA512

29bada6a9ca1789825b3d61ea3bb9ce58ce82f945c4437d0fa8313e0caeb93b6f3889b79cfe2b880da3ac86f3c846baefc2a69aa2d8e129021c3605decc9b6b5
SSDEEP

3072:Ygl5QP0wXwMaaLup2pEsCYwWXg/fGa5R8vTt3qUz0QufU5sOg9T6gSh7bFiGw+8R:/y7H9tIe37gUI9UPtFibJcsQKLH0j

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	832	werfault.exe

C:\Users\Admin\AppData\Local\Temp\ed579e51443a046ff49eb8bde112891d5f17e3c305c885c253360c5211ce3234.exe
"C:\Users\Admin\AppData\Local\Temp\ed579e51443a046ff49eb8bde112891d5f17e3c305c885c253360c5211ce3234.exe"
1⤵
PID:812
- C:\Windows\System32\werfault.exe
  \??\C:\Windows\System32\werfault.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:832

memory/812-0-0x00007FFAE2670000-0x00007FFAE2865000-memory.dmp

Filesize
2.0MB

Download
memory/832-1-0x000001D858190000-0x000001D8581A4000-memory.dmp

Filesize
80KB

Download
memory/832-2-0x000001D858430000-0x000001D858444000-memory.dmp

Filesize
80KB

Download