d4b70f445a7b07cd75211fee3ff6749e633b2e8bdd86380253d9dec595448cc2

Analysis

Target
592484360993b02060d7d5c24804f8bd.exe
Size 714KB
Sample201228-avcsqdfe7j
SHA256 d4b70f445a7b07cd75211fee3ff6749e633b2e8bdd86380253d9dec595448cc2
MD5 592484360993b02060d7d5c24804f8bd
SHA1 c4238a2bc0dc37140afbf97699e7b7c261b8f12d
SHA512 17a175f1ba77146b6648faa3b759a0b24f440eaa2f958dabc72b105599a29cabba237432034e7155f839f62cc6277370965c3f5a26219f82feb941681feb9895
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1936	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1752	1936	592484360993b02060d7d5c24804f8bd.exe	29
PID 1936 wrote to memory of 1752	1936	592484360993b02060d7d5c24804f8bd.exe	29
PID 1936 wrote to memory of 1752	1936	592484360993b02060d7d5c24804f8bd.exe	29
PID 1936 wrote to memory of 1752	1936	592484360993b02060d7d5c24804f8bd.exe	29

C:\Users\Admin\AppData\Local\Temp\592484360993b02060d7d5c24804f8bd.exe
"C:\Users\Admin\AppData\Local\Temp\592484360993b02060d7d5c24804f8bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 592
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1752

memory/1752-3-0x00000000020F0000-0x0000000002101000-memory.dmp

Download