3d51c6c8739a9038ef4a2fd3c255ccb1206ea5e4e148af61ec47867395d3540d

Analysis

Target
382cbf580429a1b47d2c8d8db13f0a20.exe
Size 456KB
Sample201016-tbfbtagm1x
SHA256 3d51c6c8739a9038ef4a2fd3c255ccb1206ea5e4e148af61ec47867395d3540d
MD5 382cbf580429a1b47d2c8d8db13f0a20
SHA1 3ce278f14c3aefc39755dfb7d405a36415e95c10
SHA512 8e70ef97028c60b4950467827a3c72adc6365fcb510b92e49000fbbdd7198621fd839fe7d8c80d4ff2a37853c1aeab1de5422ba71f643986332d2607cc059fe4
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1768	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1964	1768	382cbf580429a1b47d2c8d8db13f0a20.exe	25
PID 1768 wrote to memory of 1964	1768	382cbf580429a1b47d2c8d8db13f0a20.exe	25
PID 1768 wrote to memory of 1964	1768	382cbf580429a1b47d2c8d8db13f0a20.exe	25
PID 1768 wrote to memory of 1964	1768	382cbf580429a1b47d2c8d8db13f0a20.exe	25

C:\Users\Admin\AppData\Local\Temp\382cbf580429a1b47d2c8d8db13f0a20.exe
"C:\Users\Admin\AppData\Local\Temp\382cbf580429a1b47d2c8d8db13f0a20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 536
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

memory/1768-0-0x0000000074480000-0x0000000074B6E000-memory.dmp

Download

memory/1768-1-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/1964-4-0x00000000021A0000-0x00000000021B1000-memory.dmp

Download

memory/1964-5-0x0000000002510000-0x0000000002521000-memory.dmp

Download