62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda

Analysis

Target
62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe
Size 4KB
Sample200709-l5585rexga
SHA256 62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda
MD5 c92ba94df1978603dc92ec0e97f56055
SHA1 49debc4aaa7cc5bc257e01e5c8498acf4c8ab74e
SHA512 ec0240554152ade56cb6a169697c3b5d7c4eab0b4da091c13728ce2ecc6230176cc0546c065629090be138565870fc13450994ac257d9d61ad78296938f49f83
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	3216	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe
"C:\Users\Admin\AppData\Local\Temp\62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe"
1⤵
PID:3216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3216 -s 968
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2164

memory/2164-0-0x000002219F920000-0x000002219F921000-memory.dmp

Download

memory/2164-1-0x00000221A0560000-0x00000221A0561000-memory.dmp

Download

memory/2164-2-0x00000221A0560000-0x00000221A0561000-memory.dmp

Download