9908fa5b6b2cc9c84494474cc42668dfb4c03abaa06d79451742ef9eb5c4543f

Analysis

Target
52bb0bf42d2f05fb6a9a1ce69a082982.exe
Size 1002KB
Sample201208-437cc3vxa2
SHA256 9908fa5b6b2cc9c84494474cc42668dfb4c03abaa06d79451742ef9eb5c4543f
MD5 52bb0bf42d2f05fb6a9a1ce69a082982
SHA1 7e69c75352a9a273e7cf68466127f8fd1acb5535
SHA512 4d5e3f1852f8478eee16965580ec60143aeb8731640445b754f1f5536ab84dc03404f270b004c22f90dbd1e87e5f77a7e7a11c295e4eba83c8c056d92724e526
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	1068	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1652	1068	52bb0bf42d2f05fb6a9a1ce69a082982.exe	29
PID 1068 wrote to memory of 1652	1068	52bb0bf42d2f05fb6a9a1ce69a082982.exe	29
PID 1068 wrote to memory of 1652	1068	52bb0bf42d2f05fb6a9a1ce69a082982.exe	29
PID 1068 wrote to memory of 1652	1068	52bb0bf42d2f05fb6a9a1ce69a082982.exe	29

C:\Users\Admin\AppData\Local\Temp\52bb0bf42d2f05fb6a9a1ce69a082982.exe
"C:\Users\Admin\AppData\Local\Temp\52bb0bf42d2f05fb6a9a1ce69a082982.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 728
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652

memory/1068-2-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Download

memory/1068-3-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/1068-5-0x0000000025AA0000-0x0000000045A88000-memory.dmp

Download

memory/1068-6-0x0000000000510000-0x0000000000518000-memory.dmp

Download

memory/1652-9-0x00000000009D0000-0x00000000009E1000-memory.dmp

Download

memory/1652-12-0x0000000002710000-0x0000000002721000-memory.dmp

Download