50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609

Analysis

Target

50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe
Size

2.5MB
MD5

01c846bfc37b10ea43474e1781e0af52
SHA1

edba1b73ddd0e32784ae21844c940d7850531b82
SHA256

50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609
SHA512

94345f6c4a2b1edce2875a022f3daafff945e74a6f6a00e257379f3e4a52d99f5e969376fe6be37d5f8d76fb4afcda2a451445a203bc676f599c855703ae11cd

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1784 created 1496 1784 WerFault.exe 50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1784 1496 WerFault.exe 50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe

description	pid	process	target process
PID 1784 created 1496	1784	WerFault.exe	50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe

pid	pid_target	process	target process
1784	1496	WerFault.exe	50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1784 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1784	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe
"C:\Users\Admin\AppData\Local\Temp\50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe"
1⤵
PID:1496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1496 -s 152
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1784