87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300

Analysis

Target
ef33f7a8cc10b0b8bc636eb8c751f85f.exe
Size 708KB
Sample210422-ccbfephp96
SHA256 87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300
MD5 ef33f7a8cc10b0b8bc636eb8c751f85f
SHA1 ed95f94af84bd3ca3bad3ef57d20fdbad6925f06
SHA512 28a830e21db986f749582635cfe1c01f711648bdff13dd2e746544e2a6e7f45fa8d0c8fe3fbbd348e6d256f1dec626c548b7a230d5e51cbde2eadd4555c45736
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
780	1200	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 780	1200	ef33f7a8cc10b0b8bc636eb8c751f85f.exe	29
PID 1200 wrote to memory of 780	1200	ef33f7a8cc10b0b8bc636eb8c751f85f.exe	29
PID 1200 wrote to memory of 780	1200	ef33f7a8cc10b0b8bc636eb8c751f85f.exe	29
PID 1200 wrote to memory of 780	1200	ef33f7a8cc10b0b8bc636eb8c751f85f.exe	29

C:\Users\Admin\AppData\Local\Temp\ef33f7a8cc10b0b8bc636eb8c751f85f.exe
"C:\Users\Admin\AppData\Local\Temp\ef33f7a8cc10b0b8bc636eb8c751f85f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 652
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:780

memory/780-64-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1200-59-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/1200-61-0x00000000003A0000-0x00000000003A9000-memory.dmp

Download

memory/1200-62-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download