5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35

Analysis

Target

magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
Size

21KB
MD5

191889cccd8827cb28b5cf9c3a559366
SHA1

c1a6bc0e5d66524eaefa935e9d1dca0c9223bead
SHA256

5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35
SHA512

6d3af286eaa1c3051a739edeaa5f5684f31ff0575082bcd1c2155acfa82657b06b70d7aefc55be3dc1f0877cd4ca77b13f9e53720f5123339bf85eb36bfdfcdf

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 1592 created 3212	1592	WerFault.exe	39

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1592	3212	WerFault.exe	39

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	1592	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe
"C:\Users\Admin\AppData\Local\Temp\magnibar_5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35.exe"
1⤵
PID:3212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3212 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1592