4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc

Analysis

max time kernel
92s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 01:15

Target

4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe
Size

418KB
MD5

0e7497072e238188baf61304e3d6719a
SHA1

6f45c46a6f781bf28b9dfee19c2664eda61525b3
SHA256

4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc
SHA512

6501269ba6e862e85ffad0d7749b61c22d83a58a6c8f40127e474e335af090b5f17a877c582e124825f8c8a00211fe74708cf3b32213a6c6dac0431529e5b64e
SSDEEP

6144:in4PGoKjj/Ddjj/ujj/ujj/myoSWjagfjj/:insGoKjj/Rjj/ujj/ujj/1oakjj/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	4028	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4028	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe

C:\Users\Admin\AppData\Local\Temp\4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe
"C:\Users\Admin\AppData\Local\Temp\4e6a2ccaaee80c11efc36d0fc5b0a297b2f2bed1a6410a0a21e2d96943b1fabc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 1120
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4028 -ip 4028
1⤵
PID:2640

memory/4028-0-0x0000000000530000-0x000000000059E000-memory.dmp

Filesize
440KB

Download
memory/4028-1-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download
memory/4028-2-0x0000000005520000-0x0000000005AC4000-memory.dmp

Filesize
5.6MB

Download
memory/4028-3-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/4028-4-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/4028-5-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Filesize
40KB

Download
memory/4028-6-0x0000000075240000-0x00000000759F0000-memory.dmp

Filesize
7.7MB

Download