219b5b3cd84cc5d5a7e229ef870b7b18ac8cdc64df5abef4a9f2b3638353932c

Analysis

Target
b8658d29bc0e694167b67146649e82fb.exe
Size 875KB
Sample201007-alprevc6w6
SHA256 219b5b3cd84cc5d5a7e229ef870b7b18ac8cdc64df5abef4a9f2b3638353932c
MD5 b8658d29bc0e694167b67146649e82fb
SHA1 c5be84106412489399e3b6f503cdef14c748a4f2
SHA512 7f24d62e12727465f0ac8ef3d40b1b8126ad6570fd08cf9e524ef2da872aaa40e7f1f2957ac6930fc7e2557661d26d0b3b47a86b48fd933141bab0a616bffc8e
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	1264	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1624	1264	b8658d29bc0e694167b67146649e82fb.exe	28
PID 1264 wrote to memory of 1624	1264	b8658d29bc0e694167b67146649e82fb.exe	28
PID 1264 wrote to memory of 1624	1264	b8658d29bc0e694167b67146649e82fb.exe	28
PID 1264 wrote to memory of 1624	1264	b8658d29bc0e694167b67146649e82fb.exe	28

C:\Users\Admin\AppData\Local\Temp\b8658d29bc0e694167b67146649e82fb.exe
"C:\Users\Admin\AppData\Local\Temp\b8658d29bc0e694167b67146649e82fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 636
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624

memory/1264-0-0x0000000074230000-0x000000007491E000-memory.dmp

Download

memory/1264-1-0x0000000001330000-0x0000000001331000-memory.dmp

Download

memory/1264-3-0x0000000006D90000-0x0000000008D8F000-memory.dmp

Download

memory/1624-5-0x0000000001D50000-0x0000000001D61000-memory.dmp

Download

memory/1624-8-0x0000000002480000-0x0000000002491000-memory.dmp

Download