06812518a722af6f98fbd8c3a5ace0cad1c6d53477972618728e64bafcbc948c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 15:13

Target

FSE2.exe
Size

50KB
MD5

7a8df7276257139271a09a8947da44e5
SHA1

965c788156e2e29b6d1012430afee0cad13093b0
SHA256

8b0b9859af32d467fb7031ac8164779ffdb274cdaff959d89d11a65a365c8e12
SHA512

2769f62f0de76726c33cb0eae42c933806ddceae6c1f97d16302c575a8955fe33d4388824ca2a2c1269b09755e42b82fa5dceca825bd19e3e83ed43f97ca1f79
SSDEEP

768:ShiPG/qCn02KhWZH8Ufrg04g0r/pECkG9wR:KzrnKhWZH5frgc1R

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3964 3124 WerFault.exe FSE2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FSE2.exe

description pid process

Token: SeDebugPrivilege 3124 FSE2.exe

pid	pid_target	process	target process
3964	3124	WerFault.exe	FSE2.exe

description	pid	process
Token: SeDebugPrivilege	3124	FSE2.exe

C:\Users\Admin\AppData\Local\Temp\FSE2.exe
"C:\Users\Admin\AppData\Local\Temp\FSE2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 2176
2⤵
- Program crash
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3124 -ip 3124
1⤵
PID:3624

memory/3124-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/3124-1-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/3124-2-0x00000000057C0000-0x0000000005D64000-memory.dmp

Filesize
5.6MB

Download
memory/3124-3-0x0000000005050000-0x00000000050E2000-memory.dmp

Filesize
584KB

Download
memory/3124-4-0x0000000005D70000-0x00000000060F2000-memory.dmp

Filesize
3.5MB

Download
memory/3124-5-0x00000000051F0000-0x00000000051FC000-memory.dmp

Filesize
48KB

Download
memory/3124-6-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/3124-7-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download
memory/3124-8-0x0000000074820000-0x0000000074FD0000-memory.dmp

Filesize
7.7MB

Download