9eee4d294f2111c25d601095dc4e10e7793c99d270c47c827c7316adf1393e73

Analysis

Target

5cfa22e8d4102ffccd45ef8e80237e0f.exe
Size

965KB
MD5

5cfa22e8d4102ffccd45ef8e80237e0f
SHA1

9940e693d9a1424134e85e86bd61d278c1d31ab1
SHA256

9eee4d294f2111c25d601095dc4e10e7793c99d270c47c827c7316adf1393e73
SHA512

1038662fab4b10e73d401f33d460a0f6a492e5e8b882a0182db2693208b64eaedeac8adee4e82ec66ecad9bb55dee207f4b54e4861e5aef2c2da1f263f9a6f07

Score

10^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

640 3544 WerFault.exe 5cfa22e8d4102ffccd45ef8e80237e0f.exe
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 640 created 3544 640 WerFault.exe 5cfa22e8d4102ffccd45ef8e80237e0f.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 640 WerFault.exe
Token: SeBackupPrivilege 640 WerFault.exe
Token: SeDebugPrivilege 640 WerFault.exe

pid	pid_target	process	target process
640	3544	WerFault.exe	5cfa22e8d4102ffccd45ef8e80237e0f.exe

description	pid	process	target process
PID 640 created 3544	640	WerFault.exe	5cfa22e8d4102ffccd45ef8e80237e0f.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5cfa22e8d4102ffccd45ef8e80237e0f.exe
"C:\Users\Admin\AppData\Local\Temp\5cfa22e8d4102ffccd45ef8e80237e0f.exe"
1⤵
PID:3544

memory/640-3-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/640-4-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/640-6-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/3544-1-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/3544-2-0x0000000006240000-0x0000000006241000-memory.dmp

Filesize
4KB

Download