a949023db784c4bbd82a2ce3d6957a457efb81dae684dd92bfd3b7fce3b8f679

Analysis

Target

Ambrosial.exe
Size

15.9MB
MD5

e3635a875aa0817f0e29544ad9ff84b5
SHA1

fd65adfd5be0391790442dc1b4d21b7ee4be271a
SHA256

b9c94c4a6dca1b5a42b05e4814838a9281768ba9267803a554c23b68c0665b0f
SHA512

132ee0718115097a6b9afc2368bf652d8b04207a6822a9a9e1900bc2921d3b8de384a40eec326e1662bfd7216b29cbe85ceeb8a7d49fe8ed293c4360b8115f0a

Score

4^/10

Drops file in Windows directory 2 IoCs

Processes:

Ambrosial.exe

description ioc process

File created C:\Windows\Fonts\Azonix.otf Ambrosial.exe
File opened for modification C:\Windows\Fonts\Azonix.otf Ambrosial.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1116 1076 WerFault.exe Ambrosial.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1116 WerFault.exe
1116 WerFault.exe
1116 WerFault.exe
1116 WerFault.exe
1116 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1116 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1116 WerFault.exe

description	ioc	process
File created	C:\Windows\Fonts\Azonix.otf	Ambrosial.exe
File opened for modification	C:\Windows\Fonts\Azonix.otf	Ambrosial.exe

pid	pid_target	process	target process
1116	1076	WerFault.exe	Ambrosial.exe

pid	process
1116	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1116	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Ambrosial.exe

description	pid	process	target process
PID 1076 wrote to memory of 1116	1076	Ambrosial.exe	WerFault.exe
PID 1076 wrote to memory of 1116	1076	Ambrosial.exe	WerFault.exe
PID 1076 wrote to memory of 1116	1076	Ambrosial.exe	WerFault.exe

memory/1076-55-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/1076-57-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

Filesize
88KB

Download
memory/1076-58-0x0000000003160000-0x0000000003161000-memory.dmp

Filesize
4KB

Download
memory/1076-61-0x0000000003190000-0x0000000003192000-memory.dmp

Filesize
8KB

Download
memory/1116-59-0x0000000000000000-mapping.dmp

Download
memory/1116-60-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/1116-62-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download