2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b

Analysis

Target

magnibar_2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b.exe
Size

21KB
MD5

2953b6ec692537f8eace1077081f9e43
SHA1

6db28862c0dbb589b918f812ff61cfdac0248eab
SHA256

2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b
SHA512

11959d3841c3824e5d4c68771f67db6227423d99f5beb6559c165081b6300fb3553633ce871157bd972845730fcc9e1201c10507f114d7458b3940c8cdf0ca85

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description	pid	Process	procid_target
PID 904 created 1852	904	WerFault.exe	32

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
904	1852	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description	pid	Process
Token: SeDebugPrivilege	904	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\magnibar_2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b.exe
"C:\Users\Admin\AppData\Local\Temp\magnibar_2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b.exe"
1⤵
PID:1852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1852 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904