f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675

Resubmissions

23-08-2021 16:26

18-08-2021 20:35

22-07-2021 19:24

Target

magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
Size

21KB
MD5

4160c35d3c600712b528e8072de1bc58
SHA1

12c822103678fed7b928f0202eb7e51714ab3b56
SHA256

f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675
SHA512

f722f7a5560641b0cbeb73dfb9d495cf2920858acfdcd5806f619256f2810569486be00eee4547b07298ca20c18d478f3f567809a7b2ff9cf81519e057a3a962

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 3884 created 1456	3884	WerFault.exe	66

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3884	1456	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	3884	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe
"C:\Users\Admin\AppData\Local\Temp\magnibar_f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675.exe"
1⤵
PID:1456
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1456 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3884