9e5c166ae3b79e2a145b65a06eff8ba8281f16bc799e3850df5d3f3e06ff8e30

Analysis

Target
3c2bae9dae662563611107803c920674.exe
Size 294KB
Sample200711-bxev875l8j
SHA256 9e5c166ae3b79e2a145b65a06eff8ba8281f16bc799e3850df5d3f3e06ff8e30
MD5 3c2bae9dae662563611107803c920674
SHA1 e3d60a4fa6974aece759d4dce6e833505cb01b01
SHA512 04f6e7c292ae7744daed8fee3c47ceee1f83bd1a5f6c3d0243b3237d5ef2c7bd7c289d64631a2216ea60ef8277282467f88d287377652da7ba92bafb86bfb953
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3240	3100	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\3c2bae9dae662563611107803c920674.exe
"C:\Users\Admin\AppData\Local\Temp\3c2bae9dae662563611107803c920674.exe"
1⤵
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 892
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

memory/3240-0-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/3240-1-0x0000000005060000-0x0000000005061000-memory.dmp

Download