c29bf72d010c32acd23ca20e473dadfbe28db7d7e68971ac94cbe9d35dd3853d

Resubmissions

18/11/2021, 12:00

08/11/2021, 11:39

Target

c29bf72d010c32acd23ca20e473dadfbe28db7d7e68971ac94cbe9d35dd3853d.bin.sample.exe
Size

2.5MB
MD5

2e695b9713e69446dc1cf98e8415d206
SHA1

d4ed552548aa890b2f751619c65bd9d394dabd24
SHA256

c29bf72d010c32acd23ca20e473dadfbe28db7d7e68971ac94cbe9d35dd3853d
SHA512

f8f44a3a0d36bb179730decef65d5f70178588bbf4960c505588375fed9293855241a3ac7d02463e7cbbfb4147b2147f785e03aef3423ddf5ae45930d7bafb0b

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3020 created 2480	3020	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2480	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c29bf72d010c32acd23ca20e473dadfbe28db7d7e68971ac94cbe9d35dd3853d.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\c29bf72d010c32acd23ca20e473dadfbe28db7d7e68971ac94cbe9d35dd3853d.bin.sample.exe"
1⤵
PID:2480
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2480 -s 152
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020