375746decd0d1a3572b6df19ca831f92058ebf8973103b97405c395aa49c5bbf

Analysis

Target
88758957757.exe
Size 446KB
Sample200818-phpcj9kg3s
SHA256 375746decd0d1a3572b6df19ca831f92058ebf8973103b97405c395aa49c5bbf
MD5 b81720790aaf69b90fbe502ac738f31e
SHA1 1f04afc577ab6cf64a97e7936a89cf88a81104d0
SHA512 434a390c61d939e30bd8a0577f0744043a941c9b5f59e1d45a4a4e60eaa910f48e4ecaf504ea1034a3d0ef4ff4862efaf6cf1f3cacb2f56ba0361d81ace6ffd5
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1896	1000	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1896	1000	88758957757.exe	26
PID 1000 wrote to memory of 1896	1000	88758957757.exe	26
PID 1000 wrote to memory of 1896	1000	88758957757.exe	26
PID 1000 wrote to memory of 1896	1000	88758957757.exe	26

C:\Users\Admin\AppData\Local\Temp\88758957757.exe
"C:\Users\Admin\AppData\Local\Temp\88758957757.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 668
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896

memory/1000-0-0x0000000074230000-0x000000007491E000-memory.dmp

Download

memory/1000-1-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/1000-3-0x0000000000530000-0x0000000000534000-memory.dmp

Download

memory/1896-5-0x0000000001F90000-0x0000000001FA1000-memory.dmp

Download

memory/1896-6-0x0000000002590000-0x00000000025A1000-memory.dmp

Download