8474b7fd46e898991cbd0338ebd345bd3fd63a118168bbc662b52dff25e033cf

Analysis

Target

5.exe
Size

21KB
MD5

9f4a400b5500df75cc0ba3fc2cf9d958
SHA1

b1c4fbdce52f495c548d0de5e62e2996f6e6d31f
SHA256

8474b7fd46e898991cbd0338ebd345bd3fd63a118168bbc662b52dff25e033cf
SHA512

ddd55d6a17fb83b664a1cf1a2e50769a864b3b0178e24ea5563dfc056853ae67ff97e89bc5981b5f0869175950d2a6dccde161a0239fb643a93bed0099ce3575

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 1604 created 3492	1604	WerFault.exe	66

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1604	3492	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	1604	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
1⤵
PID:3492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3492 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1604