58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b

Analysis

Target
58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b.exe
Size 556KB
Sample210227-mae6ye6dln
SHA256 58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b
MD5 9a933217eff6a4a14bc7ba4334f83f31
SHA1 033632f1671e8bb4550b71e153258d22506c5efa
SHA512 71692d7eae0ac33096f5a7e805e4c25abc49cae93fd1b89b8e2dcce2a9bd45d2acae2a8e9a7beb91b6c5d07ac23e2b229aabf0e6b6756f7de566daec4df08f17
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
876	1924	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 876	1924	58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b.exe	26
PID 1924 wrote to memory of 876	1924	58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b.exe	26
PID 1924 wrote to memory of 876	1924	58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b.exe	26
PID 1924 wrote to memory of 876	1924	58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b.exe	26

C:\Users\Admin\AppData\Local\Temp\58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b.exe
"C:\Users\Admin\AppData\Local\Temp\58476caa3ab2733fc9e339ce77a09aa2133cc6111b78f65c3cf387f41cbb951b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 156
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:876

memory/876-4-0x00000000021F0000-0x0000000002201000-memory.dmp

Download

memory/876-5-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/1924-2-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Download