f9cff9e6050b1536e55014e7eafdc8827fb237e9235ff60265c5d1afaa5d5e6e

Analysis

Target
SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe
Size 209KB
Sample200627-cvsgwsqdex
SHA256 f9cff9e6050b1536e55014e7eafdc8827fb237e9235ff60265c5d1afaa5d5e6e
MD5 d6b2ee3825a9869e0588e361c5fa004d
SHA1 2730abe52e015eff2b01c5fbe151a4bf5bbd83c0
SHA512 5fc071524e1dfad20b54817594069318a2ed25d49d27e02a319eb2fb86beb398daf41ab68989117cd50c803ad9d83f87b2b245a321b914dc0f7c5ba85670a749
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	1508	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.Kryptik.WKX.25791.exe"
1⤵
PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1160
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3768

memory/3768-0-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download

memory/3768-1-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download