e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d

Analysis

Target
e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe
Size 558KB
Sample201004-e1mwvv3rgs
SHA256 e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d
MD5 c132f3aec5547aa6e27b84d86a149355
SHA1 6063e072aacdf4fa903eaee62a33a95a4b4db4d1
SHA512 04200c41848e3e58980489c38f61e3fe3b41cca30d35e9aed48c30d7f4239b6989c6bb6962a9bd91424b2e2c6aac9cc2977de6f7a86f376b046f923ea4caf8af
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	392	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	25
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	25
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	25
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	25

C:\Users\Admin\AppData\Local\Temp\e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe
"C:\Users\Admin\AppData\Local\Temp\e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 96
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1836

memory/1836-1-0x0000000001EC0000-0x0000000001ED1000-memory.dmp

Download

memory/1836-2-0x0000000002500000-0x0000000002511000-memory.dmp

Download