38b1b7802b0fe3b47002dc3d6cf5e3c360433bee072e4653cac2bfa61906f293

Analysis

Target
Anti.exe
Size 318KB
Sample210901-jfmma4e7y2
SHA256 38b1b7802b0fe3b47002dc3d6cf5e3c360433bee072e4653cac2bfa61906f293
MD5 fcbda965e4bb669ef5a7f4e33a5d0f68
SHA1 123acab84ba6a9aefc75f3d3f1cf129fca3bbdf6
SHA512 5dc0ce5a1c140c9c0658e1f894efeb0e4602c1bd6b17815498d1a76946b2307a701c43382ae93137c5b568bf4efd20f22ed2d711616898077ff46935ee753ffc
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2676 created 4020	2676	WerFault.exe	67

Loads dropped DLL 1 IoCs

pid	Process
4020	Anti.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	4020	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Anti.exe
"C:\Users\Admin\AppData\Local\Temp\Anti.exe"
1⤵
- Loads dropped DLL
PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 536
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676

memory/4020-115-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4020-116-0x00000000004E0000-0x000000000058E000-memory.dmp

Download

memory/4020-117-0x0000000076E80000-0x000000007700E000-memory.dmp

Download