6c551a1172a33d11b974f02a5e5489f851fcf1899e877c7e59abd2f650526c19

Target

3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe
Size

883KB
MD5

e9e137a635eccb83d460c9c583930a00
SHA1

22271f2f3e5632032d91ab0fdbce40bbd7d02126
SHA256

3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a
SHA512

ad3b8000b6d7db2d327e9be3f4a4d369306c1aea96d2113465e77fb6e24e446dd545e9b2065f91a3961f23996e46f77d5d52f7a1ea8329c983a52897a6e01355

Score

8^/10

Malware Config

Executes dropped EXE 1 IoCs

pid	Process
2928	3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	864	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
864	3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 2928	864	3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe	78
PID 864 wrote to memory of 2928	864	3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe	78
PID 864 wrote to memory of 2928	864	3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe	78

C:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe
"C:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 332
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe
  C:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe
  2⤵
  - Executes dropped EXE
  PID:2928

memory/760-2-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download