ba99ebdbb38769a5fce130e0a16cd0c2aa0380cfc4ec5dd257dcadcdcea69ee4

Analysis

Target
House Pics.exe
Size 892KB
Sample200720-ppffymfhls
SHA256 ba99ebdbb38769a5fce130e0a16cd0c2aa0380cfc4ec5dd257dcadcdcea69ee4
MD5 5bdf485867aa3d87b494be177e7c98da
SHA1 3201fd68704cfa89e9f32f807cb1cdf4bf39bc45
SHA512 214e0b6a6d95243587e6df856095180d9d475536d2a01b52573f389a38d1659c94747a51cae51c7748e19d7455549efac0f3c4efcb82a51d09687b2273621f42
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2536	WerFault.exe	67

C:\Users\Admin\AppData\Local\Temp\House Pics.exe
"C:\Users\Admin\AppData\Local\Temp\House Pics.exe"
1⤵
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 908
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:2656

memory/2656-0-0x0000000005090000-0x0000000005091000-memory.dmp

Download

memory/2656-1-0x0000000005910000-0x0000000005911000-memory.dmp

Download