5e210a42996ad14924d70184043cb304be7f555a20d8937ae4502e01d4cf33aa

Analysis

Target

5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477.exe
Size

3.1MB
MD5

298b9c281bab03460621171d76476850
SHA1

7c4027418a000c68372b251a2fc152b10acf502f
SHA256

5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477
SHA512

55a3223021fb5e66ac5227d24930e70a454dea04393e534aa2d057a53013cf18370572656b06170d5fe0998c6c89656a751fc4f31a8e9c95b4ec3e7dbac9cd80

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3120 created 756	3120	WerFault.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3120	756	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477.exe
"C:\Users\Admin\AppData\Local\Temp\5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477.exe"
1⤵
PID:756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 756 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3120