d749f756093b6a3ee4d5265ea6f9e82aa517c754487fcbebb7a748324cbcd10e

Analysis

Target
23ab275366b16055b5e7eb150d65b0b8.exe
Size 360KB
Sample200625-7hhfpdtgrs
SHA256 d749f756093b6a3ee4d5265ea6f9e82aa517c754487fcbebb7a748324cbcd10e
MD5 23ab275366b16055b5e7eb150d65b0b8
SHA1 05063c702977c24a1cc7bd5bdc8ac1e7c0479a2b
SHA512 69d69e028a7ce954ec10125bb7ce7d767718f2bd918a9e1044cf0708a4d3796cada8308127a378b3c89cab5aeef61d2c49cfb702aa066315c6a817e861694ee7
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	3144	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\23ab275366b16055b5e7eb150d65b0b8.exe
"C:\Users\Admin\AppData\Local\Temp\23ab275366b16055b5e7eb150d65b0b8.exe"
1⤵
PID:3144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 904
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128

memory/2128-0-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/2128-1-0x0000000005000000-0x0000000005001000-memory.dmp

Download