a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13

Analysis

Target
a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13.exe
Size 58KB
Sample200629-87x9d22ea6
SHA256 a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13
MD5 ecfa8fad85df635aadee4f44f3daafeb
SHA1 1c71cbcd11b1ac31ea2e8f9636e0558a42850d13
SHA512 7018f463592be4cf926dc6ff2980858e0814849759da9faad6fec604f40ff999eb9bb13318b012130d157fab90515e293909a2c6250db267913716add596a562
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1496	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1708	1496	a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13.exe	24
PID 1496 wrote to memory of 1708	1496	a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13.exe	24
PID 1496 wrote to memory of 1708	1496	a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13.exe	24
PID 1496 wrote to memory of 1708	1496	a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13.exe
"C:\Users\Admin\AppData\Local\Temp\a6969df5b378c0ac923dfceaac03c45afc9588c8a5a11ed9d74e78db61b04a13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 468
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

memory/1708-1-0x00000000021E0000-0x00000000021F1000-memory.dmp

Download

memory/1708-2-0x0000000002830000-0x0000000002841000-memory.dmp

Download