ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67

Analysis

Target
ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe
Size 98KB
Sample201018-nt6br42das
SHA256 ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67
MD5 5946eea73e2692f395c1b05f99863a43
SHA1 dfd621d5ff5fe5213284c7a876785dfd75d4018e
SHA512 e1832de1b16ad4aea01044591d93149d1c40dd645a27c3a9f69a926632e8c61d0419107de862abf34f2ba344af9903d95d9ad5a54e58c9f713d4058541dc30e2
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1120	1076	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	25
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	25
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	25
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	25

C:\Users\Admin\AppData\Local\Temp\ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe
"C:\Users\Admin\AppData\Local\Temp\ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 128
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120

memory/1120-1-0x0000000001FA0000-0x0000000001FB1000-memory.dmp

Download

memory/1120-2-0x0000000002470000-0x0000000002481000-memory.dmp

Download