c3a2aedb10f9b59ecfc94aafcc041c885727f5f34d1db8bb9ff41cd910ef4eab

Analysis

Target
SecuriteInfo.com.Trojan.GenericKD.36392080.3322.10919.exe
Size 29KB
Sample210317-enfxym9yr2
SHA256 c3a2aedb10f9b59ecfc94aafcc041c885727f5f34d1db8bb9ff41cd910ef4eab
MD5 a82d01c1f4a5dbea2a922581f6727d51
SHA1 54f6c84a6c556537955680a357d69df4bc5d8848
SHA512 de2929ce0590402a222d3d728121987fc526b9770aa836b64d7bc81855f418af63f9e10f403ff32e5c9c9ca60bfa0de1ee17eb0836d9cf090c7882796d8e3f14
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4964 created 4776	4964	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	4776	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36392080.3322.10919.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36392080.3322.10919.exe"
1⤵
PID:4776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4776 -s 172
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964