8114e5e30720952dbf0515a5f3801c7c0ef51844758e25b100b768a29c01155a

Analysis

Target

vbc.exe
Size

335KB
MD5

dcbed5a043d3eca73e3451f66718882f
SHA1

48d598c8d8cdef964d51c20fcf90421abb4da85a
SHA256

8114e5e30720952dbf0515a5f3801c7c0ef51844758e25b100b768a29c01155a
SHA512

cc82b9c701dacd25be9038be9c506b36a75d495cb96143e77d050562f21a4c83876826203bce0766ab34369569efafe9f7415cab8ae68582a3219f6e624e80c9

Score

7^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2900	2416	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 916
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2900

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2900-0-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/2900-1-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download