427d60e19ce674f0b7ea11644a52eb73ea26695bc0758591f96262f4818659c2

Analysis

max time kernel
1s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 02:06

Target

Valhalla_.exe
Size

2.6MB
MD5

a1259f366f5260966f2ab003d614a394
SHA1

cd77b0a83d61e8532a6c2623006ca7924c7d991d
SHA256

427d60e19ce674f0b7ea11644a52eb73ea26695bc0758591f96262f4818659c2
SHA512

344d7fd4b14c8bfb0cf19fc8e218eb3951e6d1b77e8da7101139211bcb825a6a2515700bcdf85191a626c10bb8956d86fde900b05adb4293938c40eb92eb56ea
SSDEEP

24576:ZpovMxG2GAbRyOizlRVoHiHxOe6Gaa4t9j0MJIc9yOjdi1ULYtqcVbIGrCHXbnxU:ZKksAbRZiznVoHi4IJejS+V01/ocT8FU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1360 1220 WerFault.exe Valhalla_.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Valhalla_.exe

description pid process

Token: SeDebugPrivilege 1220 Valhalla_.exe

pid	pid_target	process	target process
1360	1220	WerFault.exe	Valhalla_.exe

description	pid	process
Token: SeDebugPrivilege	1220	Valhalla_.exe

C:\Users\Admin\AppData\Local\Temp\Valhalla_.exe
"C:\Users\Admin\AppData\Local\Temp\Valhalla_.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 1096
2⤵
- Program crash
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1220 -ip 1220
1⤵
PID:1828

memory/1220-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

Filesize
4KB

Download
memory/1220-1-0x00000000003C0000-0x0000000000662000-memory.dmp

Filesize
2.6MB

Download
memory/1220-2-0x0000000005890000-0x0000000005E36000-memory.dmp

Filesize
5.6MB

Download
memory/1220-3-0x0000000005150000-0x00000000051E2000-memory.dmp

Filesize
584KB

Download
memory/1220-4-0x0000000074A00000-0x00000000751B1000-memory.dmp

Filesize
7.7MB

Download
memory/1220-5-0x0000000005220000-0x000000000522A000-memory.dmp

Filesize
40KB

Download
memory/1220-6-0x0000000074A00000-0x00000000751B1000-memory.dmp

Filesize
7.7MB

Download