169605839aebe681cc8f32304083932a0a710dad4d24c900a9dc17d92f6efd29

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 01:15

Target

FSE2.exe
Size

50KB
MD5

3edc1fc459ea2dc098722261ec3fbe05
SHA1

8fbb8efa0a3ba27d29a184a4b182ff537f82c9a8
SHA256

89f3cdd4c1e20eeac4d39fa709d40e8f3ebd8985a0a76673a44cf117eeeb458b
SHA512

a6cf1c104f8dece689cd21f7d65d510f07e86d25600f42d61838a664fbf640ead66fe4523499a38f37951faa3028bd469ad8f483287f986218f8cbfb50f3256d
SSDEEP

768:PhiPG/q1nVY2kh5yGJMwCH8Ufrg04g0rTpEIkGAwd:pzonVXkhVJMwCH5frgiMd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3652 1704 WerFault.exe FSE2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

FSE2.exe

description pid process

Token: SeDebugPrivilege 1704 FSE2.exe

pid	pid_target	process	target process
3652	1704	WerFault.exe	FSE2.exe

description	pid	process
Token: SeDebugPrivilege	1704	FSE2.exe

C:\Users\Admin\AppData\Local\Temp\FSE2.exe
"C:\Users\Admin\AppData\Local\Temp\FSE2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 2228
2⤵
- Program crash
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1704 -ip 1704
1⤵
PID:4564

memory/1704-0-0x000000007474E000-0x000000007474F000-memory.dmp

Filesize
4KB

Download
memory/1704-1-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1704-2-0x0000000005510000-0x0000000005AB4000-memory.dmp

Filesize
5.6MB

Download
memory/1704-3-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/1704-4-0x0000000005220000-0x0000000005396000-memory.dmp

Filesize
1.5MB

Download
memory/1704-5-0x0000000004F40000-0x0000000004F4C000-memory.dmp

Filesize
48KB

Download
memory/1704-6-0x00000000051A0000-0x00000000051B0000-memory.dmp

Filesize
64KB

Download
memory/1704-7-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/1704-8-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download