7fb67bde1b0688e9bbf598debf14722f231c534edd2f82d85c3aba28a85e0391

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 09:58

Target

c04d5253c77dfddc53954ce3698a6b92.exe
Size

52KB
MD5

c04d5253c77dfddc53954ce3698a6b92
SHA1

573bfd093d61ad4d40dd74ca2d778733ea38ccd1
SHA256

7fb67bde1b0688e9bbf598debf14722f231c534edd2f82d85c3aba28a85e0391
SHA512

5e024e1da1683492e7f0d016e617dc9146f9a05e275e6807fb8ea054537e062dd623c6016cd12329e6901e5e25c0529a8795946539142ab34d9fba7f02e5fe74
SSDEEP

768:VrauVUF9SKVnNVwkMUDd8lwBPzgJbQnwvqXa5Ze2Tulg5z/o:VrhU7XNDz5hwv4as65z/o

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4544	4240	WerFault.exe	101

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	c04d5253c77dfddc53954ce3698a6b92.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101
PID 4828 wrote to memory of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101
PID 4828 wrote to memory of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101
PID 4828 wrote to memory of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101
PID 4828 wrote to memory of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101
PID 4828 wrote to memory of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101
PID 4828 wrote to memory of 4240	4828	c04d5253c77dfddc53954ce3698a6b92.exe	101

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4240 -ip 4240
1⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=3016,i,1323102786462900035,7687994236215859601,262144 --variations-seed-version /prefetch:8
1⤵
PID:4784

memory/4240-3-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4240-5-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/4828-0-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/4828-1-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download
memory/4828-2-0x0000000000B70000-0x0000000000B80000-memory.dmp

Filesize
64KB

Download
memory/4828-7-0x0000000075450000-0x0000000075A01000-memory.dmp

Filesize
5.7MB

Download