767a951ea1f41e10287199d95ffed5a84a94e1d33d82d519c91db89d37941f42

Analysis

Target
Antic Ghost Client.exe
Size 3.4MB
Sample210820-87epvpxqbx
SHA256 767a951ea1f41e10287199d95ffed5a84a94e1d33d82d519c91db89d37941f42
MD5 21bbb1625ea28415e3370304c8d02f20
SHA1 0602488f6144d1443b63136c5a1531731da91daa
SHA512 6b9acc5401a3b87f24c514c1076d9f3ea81125befead1d6835f4e555bbf5eb7d5de1e916ac609eb7bbe5f4cefbf0f85939981b55b272017d0f2a42c05360efbe
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	2272	WerFault.exe	74

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	WerFault.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2272	808	Antic Ghost Client.exe	74
PID 808 wrote to memory of 2272	808	Antic Ghost Client.exe	74

C:\Users\Admin\AppData\Local\Temp\Antic Ghost Client.exe
"C:\Users\Admin\AppData\Local\Temp\Antic Ghost Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -classpath "C:\Users\Admin\AppData\Local\Temp\Antic Ghost Client.exe" com.fasterxml.jackson.core.json.async.JacksonModifier
  2⤵
  PID:2272
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2272 -s 352
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3936