6ebaa542dcd9f166b05338acb13c4c757cff7bf13305be412b9617e127924c88

Analysis

Target
Scan doc.exe
Size 895KB
Sample210713-av12e43max
SHA256 6ebaa542dcd9f166b05338acb13c4c757cff7bf13305be412b9617e127924c88
MD5 4f5c64ce868bbf09ba0c3825969e4ee6
SHA1 91e419faa7fef44e138db6272745b558d3ef0157
SHA512 4c4f90b1fbc0f1ffb7620201bd95d1025ed190b44c8719cef14f199a7310d60813f1bb4211b1b0d0cf2681d6e70e18554be8a5fd88d10542b337661b242e1141
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
792	2016	WerFault.exe	15

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 792	2016	Scan doc.exe	29
PID 2016 wrote to memory of 792	2016	Scan doc.exe	29
PID 2016 wrote to memory of 792	2016	Scan doc.exe	29
PID 2016 wrote to memory of 792	2016	Scan doc.exe	29

C:\Users\Admin\AppData\Local\Temp\Scan doc.exe
"C:\Users\Admin\AppData\Local\Temp\Scan doc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 628
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:792

memory/792-65-0x0000000000350000-0x0000000000351000-memory.dmp

Download

memory/2016-60-0x00000000011F0000-0x00000000011F1000-memory.dmp

Download

memory/2016-62-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Download

memory/2016-63-0x0000000000240000-0x0000000000250000-memory.dmp

Download