0b5b880307bbb0233d7acf9685b9ef0d596657c4a52b6096f998689d743ec168

Analysis

Target
2.exe
Size 63KB
Sample200713-mpf6mmlphs
SHA256 0b5b880307bbb0233d7acf9685b9ef0d596657c4a52b6096f998689d743ec168
MD5 807e68132cc9f6def300da6cd8c6417c
SHA1 da00155621e459ecbb2b7cebe8ca4e2137b4ee76
SHA512 5c782232964e68ec00e89c8f6bfc17c9d57d7978a4fb7c6b36d878a61c48aaf8ee01c2ffb80857bb2866a387e9ee840fddb88f034dbda29a81240d2906146fcd
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1228	1100	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1228	1100	2.exe	24
PID 1100 wrote to memory of 1228	1100	2.exe	24
PID 1100 wrote to memory of 1228	1100	2.exe	24
PID 1100 wrote to memory of 1228	1100	2.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 200
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

memory/1228-1-0x0000000001EE0000-0x0000000001EF1000-memory.dmp

Download

memory/1228-2-0x0000000002470000-0x0000000002481000-memory.dmp

Download