73756dd47abcedb8cbd652643ff4edb42e43cebf5b576291f604f684e0612280

Analysis

Target
19759E739821AB50929A37120E30B0FB.exe
Size 673KB
Sample210601-ndarp469w6
SHA256 73756dd47abcedb8cbd652643ff4edb42e43cebf5b576291f604f684e0612280
MD5 19759e739821ab50929a37120e30b0fb
SHA1 a8cb9e3cb54ff123f6d016061da943f11d3d0b35
SHA512 b4e9ad3c22ddf1e8b9ef0a2765b2e5e6f4878d8ff738c9b82c59fd07ea9d85ab655b2c53539d7a064a8d784aee08024071859c2f76de87491725ee4dfb43e553
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2580 created 3008	2580	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	3008	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\19759E739821AB50929A37120E30B0FB.exe
"C:\Users\Admin\AppData\Local\Temp\19759E739821AB50929A37120E30B0FB.exe"
1⤵
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 780
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580

memory/3008-115-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3008-114-0x00000000021F0000-0x0000000002287000-memory.dmp

Download