Analysis
-
max time kernel
13s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
30-07-2021 09:53
General
-
Target
50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe
-
Size
2.5MB
-
MD5
01c846bfc37b10ea43474e1781e0af52
-
SHA1
edba1b73ddd0e32784ae21844c940d7850531b82
-
SHA256
50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609
-
SHA512
94345f6c4a2b1edce2875a022f3daafff945e74a6f6a00e257379f3e4a52d99f5e969376fe6be37d5f8d76fb4afcda2a451445a203bc676f599c855703ae11cd
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe"C:\Users\Admin\AppData\Local\Temp\50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1496 -s 1522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-