9f72ed1dc20575f4e19a75256a0df8871561008ce1387e12d932598c21a5b16f

Analysis

Target

7.exe
Size

21KB
MD5

555aee36e8e1c0e684e658b9ef65bc83
SHA1

f8afbddf6e6ab23f914f961b2eedc51f8b78fabd
SHA256

9f72ed1dc20575f4e19a75256a0df8871561008ce1387e12d932598c21a5b16f
SHA512

b65578a6c9ed2d9262776a73ebb230aa3deeb7e4aa829add17024609261c58dd9e941d6ebde5a6dcac824b56df8d7dccce4938d498069800cc63f14a05513b52

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 1240 created 2016	1240	WerFault.exe	54

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1240	2016	WerFault.exe	54

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	1240	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
1⤵
PID:2016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2016 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240