b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b

Analysis

Target
b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b.exe
Size 5KB
Sample200709-673kqlkh76
SHA256 b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b
MD5 3df04716db7e3ec08648ebdf090ca36e
SHA1 ab0c6268c61d9f36996ba7653b3a3e1ede2aee51
SHA512 83c4f2c5aa5ddd512f80b96d523376074268ddcc3b8895c95391635edbca127a16a4ffc340ae4d7f658c862d7dd720ad185464c7796aa08fec699f78057fbfc7
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	880	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1028	880	b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b.exe	24
PID 880 wrote to memory of 1028	880	b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b.exe	24
PID 880 wrote to memory of 1028	880	b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b.exe	24
PID 880 wrote to memory of 1028	880	b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b.exe
"C:\Users\Admin\AppData\Local\Temp\b4cadce114cd67f9c8e852b20be0ab7cb1e60372c59db88042d0cc853f71272b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 700
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

memory/1028-1-0x0000000001F30000-0x0000000001F41000-memory.dmp

Download

memory/1028-2-0x0000000002600000-0x0000000002611000-memory.dmp

Download