5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c

Analysis

Target
5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c.exe
Size 729KB
Sample201110-6c132antmn
SHA256 5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c
MD5 2b781857be42e4f0fcd554ea35d25177
SHA1 834545a1d643a18803c427dfe41e9c528ea4981b
SHA512 a788d38441aee5e06ff085860876740d2e6bf99242914264994a3e8105b9e773c71fcec5e48efba745871421f4263435f1918d3779fce253f0690be53354be3f
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
888	1900	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	888	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 888	1900	5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c.exe	26
PID 1900 wrote to memory of 888	1900	5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c.exe	26
PID 1900 wrote to memory of 888	1900	5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c.exe	26
PID 1900 wrote to memory of 888	1900	5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c.exe	26

C:\Users\Admin\AppData\Local\Temp\5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c.exe
"C:\Users\Admin\AppData\Local\Temp\5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 284
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:888

memory/888-1-0x0000000001FE0000-0x0000000001FF1000-memory.dmp

Download

memory/888-2-0x00000000026A0000-0x00000000026B1000-memory.dmp

Download

memory/888-3-0x00000000026A0000-0x00000000026B1000-memory.dmp

Download