72d119f2e637939b29d3399f95d617148fd2c5ef09e21e985a52108e53e4a5b2

Analysis

Target
76gJAocUSVCetXw.exe
Size 727KB
Sample201014-gp7twhpdsx
SHA256 72d119f2e637939b29d3399f95d617148fd2c5ef09e21e985a52108e53e4a5b2
MD5 cde3f784bb23e56a890738d00c17e10d
SHA1 9b1bec89a3f0c020f278d52b4aa4e879eb9050e7
SHA512 8bddd589c691dfbabb776c0019d044cf5c50c332f2e2a5883fc387c8f614e0f74d360ad7b6686a3db19549b13844301948968cdf99551071bd07c6d17fec6280
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	1124	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1940	1124	76gJAocUSVCetXw.exe	28
PID 1124 wrote to memory of 1940	1124	76gJAocUSVCetXw.exe	28
PID 1124 wrote to memory of 1940	1124	76gJAocUSVCetXw.exe	28
PID 1124 wrote to memory of 1940	1124	76gJAocUSVCetXw.exe	28

C:\Users\Admin\AppData\Local\Temp\76gJAocUSVCetXw.exe
"C:\Users\Admin\AppData\Local\Temp\76gJAocUSVCetXw.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 668
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940

memory/1124-0-0x0000000073F00000-0x00000000745EE000-memory.dmp

Download

memory/1124-1-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/1124-3-0x0000000004CD0000-0x00000000054D0000-memory.dmp

Download

memory/1124-4-0x0000000005E20000-0x0000000005EC1000-memory.dmp

Download

memory/1940-6-0x0000000001FF0000-0x0000000002001000-memory.dmp

Download

memory/1940-7-0x00000000026C0000-0x00000000026D1000-memory.dmp

Download