fc1cb9ea6c1d86600f690b0f7c7ea6ab73d401a3b0e899360c4a619aeaed4cc4

Analysis

Target

1.exe
Size

21KB
MD5

3802b905937b9212384ce6ed7241d96c
SHA1

9ef9f19a2327bce05bbb5cc23021f5c2b7cd1cec
SHA256

fc1cb9ea6c1d86600f690b0f7c7ea6ab73d401a3b0e899360c4a619aeaed4cc4
SHA512

bac5dc5c299979461ad7eb3f329c9b61042b3d7cb261acdcdd14111741a549c986ea19c871564d9c799d2da7a042ab9f1918efcfcddc3bfe51a4d1aaf3c39d9b

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 908 created 1496	908	WerFault.exe	68

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
908	1496	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	908	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
PID:1496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1496 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:908