16be5ad3f7286dd2f2ca199bc0bfb6d8d8fd4b88107c0c7d16cfcf6df4c97583

Analysis

Target
0024356BD.exe
Size 776KB
Sample201014-kcjc2rm5ax
SHA256 16be5ad3f7286dd2f2ca199bc0bfb6d8d8fd4b88107c0c7d16cfcf6df4c97583
MD5 5796b886afc44a5e647cd402e092815a
SHA1 6f8ab83564da6e2b18600e9e5b5285d9f9c37025
SHA512 ea80792d61cf359394a465b102e05b8f26cd721e94d340b43954ddd81fb0d4126be19f6cee97c98fafbc890fd339608aee2c174444c323de91162e2ed653fffb
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1408	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1612	1408	0024356BD.exe	28
PID 1408 wrote to memory of 1612	1408	0024356BD.exe	28
PID 1408 wrote to memory of 1612	1408	0024356BD.exe	28
PID 1408 wrote to memory of 1612	1408	0024356BD.exe	28

C:\Users\Admin\AppData\Local\Temp\0024356BD.exe
"C:\Users\Admin\AppData\Local\Temp\0024356BD.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 672
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612

memory/1408-0-0x0000000074CB0000-0x000000007539E000-memory.dmp

Download

memory/1408-1-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/1408-3-0x0000000004FE0000-0x00000000057E0000-memory.dmp

Download

memory/1408-4-0x00000000049E0000-0x0000000004A5D000-memory.dmp

Download

memory/1612-6-0x0000000001E50000-0x0000000001E61000-memory.dmp

Download

memory/1612-9-0x0000000002810000-0x0000000002821000-memory.dmp

Download