f1e27e0dbf418da288b43f2dd8bd89f494558fa4ffa12ad1ba8e8cabe9f47c7d

Analysis

Target
ac0e6d08a5c501932ae5eea36000e7d1.exe
Size 557KB
Sample210422-dsmgsfbvjs
SHA256 f1e27e0dbf418da288b43f2dd8bd89f494558fa4ffa12ad1ba8e8cabe9f47c7d
MD5 ac0e6d08a5c501932ae5eea36000e7d1
SHA1 00fb6958801365f21cd2f21669adf1c90f64a221
SHA512 13f63a72ea2217720ed38c1f045a8afb66445112bc0afba3d3d20f49e916e77980cf1bcf640ac1097c8fd2c2a287bb7225e0aaadbf17b459f9fc33ad63c7a412
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
564	784	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 564	784	ac0e6d08a5c501932ae5eea36000e7d1.exe	29
PID 784 wrote to memory of 564	784	ac0e6d08a5c501932ae5eea36000e7d1.exe	29
PID 784 wrote to memory of 564	784	ac0e6d08a5c501932ae5eea36000e7d1.exe	29
PID 784 wrote to memory of 564	784	ac0e6d08a5c501932ae5eea36000e7d1.exe	29

C:\Users\Admin\AppData\Local\Temp\ac0e6d08a5c501932ae5eea36000e7d1.exe
"C:\Users\Admin\AppData\Local\Temp\ac0e6d08a5c501932ae5eea36000e7d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 656
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:564

memory/564-65-0x0000000000200000-0x0000000000292000-memory.dmp

Download

memory/784-60-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/784-62-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/784-63-0x00000000003F0000-0x00000000003F9000-memory.dmp

Download