10939877f109569dff853eef9ddb462dda69871bc04b44d45d1a784a21a208ba

Analysis

Target
Attached AWB.exe
Size 943KB
Sample200710-6fameefll6
SHA256 10939877f109569dff853eef9ddb462dda69871bc04b44d45d1a784a21a208ba
MD5 63ae3d497fc808ba1f4c5109d76c457f
SHA1 6d7e6c8743f130c0a23551061516b47a9510729b
SHA512 70ab3ea48525ffb2b5a354c46ae1684226d756855fd61859c705827b0c71cbefd88f5e5ce93cb720f0fe638b89b4b1a3736976798d6cbe0262c94b1effaf2ba5
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	1492	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\Attached AWB.exe
"C:\Users\Admin\AppData\Local\Temp\Attached AWB.exe"
1⤵
PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 896
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2732

memory/2732-0-0x0000000004680000-0x0000000004681000-memory.dmp

Download

memory/2732-1-0x0000000004B70000-0x0000000004B71000-memory.dmp

Download