ca035ce2804aff96e07142ecb344766e2fca568af3b5b01f60d7886225d7cd49

Analysis

Target

insz.exe
Size

209KB
MD5

394f9f303f2a0039f204a23c0a5ad1a7
SHA1

a84f6b731446c79f491292a46133087825cdc0ca
SHA256

ca035ce2804aff96e07142ecb344766e2fca568af3b5b01f60d7886225d7cd49
SHA512

ca16a81380c60f0e705e089bfaed815b0a050b4bbadbea1a54332f816a4cfb5535d86f86c93a865d84747e7a32c73193658b6ea5ec72d44cf915b519f6f9af21

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

insz.exe

description pid process target process

PID 1676 set thread context of 1352 1676 insz.exe insz.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 1352 WerFault.exe insz.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1424 WerFault.exe
1424 WerFault.exe
1424 WerFault.exe
1424 WerFault.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

insz.exe

pid process

1676 insz.exe
1676 insz.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1424 WerFault.exe

description	pid	process	target process
PID 1676 set thread context of 1352	1676	insz.exe	insz.exe

pid	pid_target	process	target process
1424	1352	WerFault.exe	insz.exe

pid	process
1676	insz.exe
1676	insz.exe

description	pid	process
Token: SeDebugPrivilege	1424	WerFault.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

insz.exeinsz.exe

description	pid	process	target process
PID 1676 wrote to memory of 1352	1676	insz.exe	insz.exe
PID 1676 wrote to memory of 1352	1676	insz.exe	insz.exe
PID 1676 wrote to memory of 1352	1676	insz.exe	insz.exe
PID 1676 wrote to memory of 1352	1676	insz.exe	insz.exe
PID 1676 wrote to memory of 1352	1676	insz.exe	insz.exe
PID 1352 wrote to memory of 1424	1352	insz.exe	WerFault.exe
PID 1352 wrote to memory of 1424	1352	insz.exe	WerFault.exe
PID 1352 wrote to memory of 1424	1352	insz.exe	WerFault.exe
PID 1352 wrote to memory of 1424	1352	insz.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\insz.exe
"C:\Users\Admin\AppData\Local\Temp\insz.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1352

memory/1352-3-0x000000000008ECF0-mapping.dmp

Download
memory/1424-4-0x0000000000000000-mapping.dmp

Download
memory/1424-5-0x0000000001CD0000-0x0000000001CE1000-memory.dmp

Filesize
68KB

Download
memory/1424-6-0x00000000024D0000-0x00000000024E1000-memory.dmp

Filesize
68KB

Download
memory/1424-8-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/1676-2-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download