4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7

Analysis

Target

4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe
Size

21KB
MD5

e0fa3beea2fdf9c48e26d128f624aa90
SHA1

d853e4f29d2832c3830441613cfe7f23889c660e
SHA256

4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7
SHA512

4a549ec73a4e0fbc5285152bcb5c35da95d9bcc79e7f0b1c1d844bc4ce5d6639084246fea4a7e79285a12c82fa59046cef8a77870db895f573a88df6ec601dcf

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 2508 created 640	2508	WerFault.exe	66

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2508	640	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	2508	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe
"C:\Users\Admin\AppData\Local\Temp\4a8291d1b7e90e942220471d1335a544d59791d693a3065f0cff46632cd821c7.exe"
1⤵
PID:640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 640 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508