f344f9a579f46f453c4bd43a970d90c7def7882718f87fc3abed83fdfef087a5

Analysis

Target
file.exe
Size 574KB
Sample200624-ysxnnme862
SHA256 f344f9a579f46f453c4bd43a970d90c7def7882718f87fc3abed83fdfef087a5
MD5 5d6e306bdb02190ebd2eced227d3d209
SHA1 84828e808e971e528618b65653332483003d8ed7
SHA512 59b2d233e800a93403946b2ab1361f35e6cbe94f8401dfb474b8fe3e5d22c025598d40172b487c25560c3b771f34c0a1a84da743f34df016e2f42eb3342a33a3
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	992	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1168
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3836

memory/3836-0-0x00000000047E0000-0x00000000047E1000-memory.dmp

Download

memory/3836-1-0x00000000047E0000-0x00000000047E1000-memory.dmp

Download

memory/3836-4-0x00000000049E0000-0x00000000049E1000-memory.dmp

Download