f9cf0fafb332a52c2d95e3d18ad6b0f3d7836166fb105cb38970bec2bddd1daa

Analysis

Target

SUNBURST/FireEyeTools/82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe
Size

17KB
MD5

562ecbba043552d59a0f23f61cea0983
SHA1

472af2b122c23bf0ca10c78d389a5a7f030a3536
SHA256

82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6
SHA512

96e57af877fb1b6c6508326c25e44f01613342eeee731d49ba68fe82fdd3ea6aa82fc4bbad8fdee2ace3081a89792fb2b5b57f6a8dc533113f9c01c0f1141c1b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

848 1864 WerFault.exe 82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

848 WerFault.exe
848 WerFault.exe
848 WerFault.exe
848 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 848 WerFault.exe

pid	pid_target	process	target process
848	1864	WerFault.exe	82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe

description	pid	process
Token: SeDebugPrivilege	848	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe

description	pid	process	target process
PID 1864 wrote to memory of 848	1864	82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe	WerFault.exe
PID 1864 wrote to memory of 848	1864	82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe	WerFault.exe
PID 1864 wrote to memory of 848	1864	82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SUNBURST\FireEyeTools\82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe
"C:\Users\Admin\AppData\Local\Temp\SUNBURST\FireEyeTools\82cce26c60a5105e6caf5ac92eabb3dedcd883cd075f2056f27b0ec58aefaaa6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

memory/848-2-0x0000000000000000-mapping.dmp

Download
memory/848-3-0x0000000002080000-0x0000000002091000-memory.dmp

Filesize
68KB

Download
memory/848-4-0x00000000027D0000-0x00000000027E1000-memory.dmp

Filesize
68KB

Download