f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675

Analysis

Target

3.exe
Size

21KB
MD5

4160c35d3c600712b528e8072de1bc58
SHA1

12c822103678fed7b928f0202eb7e51714ab3b56
SHA256

f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675
SHA512

f722f7a5560641b0cbeb73dfb9d495cf2920858acfdcd5806f619256f2810569486be00eee4547b07298ca20c18d478f3f567809a7b2ff9cf81519e057a3a962

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 1652 created 656	1652	WerFault.exe	67

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1652	656	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	1652	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
PID:656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 656 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652