fe9b84c61e72703a67b2b0adf482da7d704972dd65cef9e33e3b2003f7bf7625

Analysis

Target
chusices.exe
Size 1.1MB
Sample200818-pt9wfd3s46
SHA256 fe9b84c61e72703a67b2b0adf482da7d704972dd65cef9e33e3b2003f7bf7625
MD5 77c494e0c9f8f2319ad368a3143831d5
SHA1 df5af8476d1f5e8e53e8513c3eddf395d6d4ea6d
SHA512 6f53caa509d1258076324f71de5a2a13a905e24fac4d03cb6c50f9fb5c70f72501e37a81b5c0969286ec394f95537d8957fc1d4aab9d1d36a4cfe95060de3b9e
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	108	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1520	108	chusices.exe	24
PID 108 wrote to memory of 1520	108	chusices.exe	24
PID 108 wrote to memory of 1520	108	chusices.exe	24
PID 108 wrote to memory of 1520	108	chusices.exe	24

C:\Users\Admin\AppData\Local\Temp\chusices.exe
"C:\Users\Admin\AppData\Local\Temp\chusices.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 600
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

memory/108-0-0x0000000074130000-0x000000007481E000-memory.dmp

Download

memory/108-1-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/1520-4-0x0000000001F20000-0x0000000001F31000-memory.dmp

Download

memory/1520-7-0x00000000025F0000-0x0000000002601000-memory.dmp

Download