8be410717226b5e873c61a30d92a767c6c6492ce6358cd79b2a41cb23dba05cd

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 09:31

Target

PersonMgrV108A/PersonMgr.exe
Size

176KB
MD5

43a1922f49ebc97ad4ba44f52465845a
SHA1

41600e6acb37342d0516ba31baade3afeff82d17
SHA256

1b694e0c48c8f6a9c57266ea623f8c4a4169350512294cd0f7345ecf72ea8308
SHA512

aacdc8e0edf420f1ad2e2ae1dadd4c85d62a759293a9cf0b36424d4f8d646584c417a9d3685be16c7f5872b629d9bb7666b74a6121eb28eaa5aa07da340d9892
SSDEEP

3072:VCBJu8Mg/szgDywubOg6mF3AFryNubdaoGuxIG8wMiMkJWk4oyOu:KJ/aP7Z3eKubduuxIvMHy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	3288	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3288	PersonMgr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3288	PersonMgr.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3288	PersonMgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3288	PersonMgr.exe
3288	PersonMgr.exe

C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\PersonMgr.exe
"C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\PersonMgr.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 932
  2⤵
  - Program crash
  PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3288 -ip 3288
1⤵
PID:5036