8561226f674aeb4abc1b9910ddc4855ac8ac2fcd4f5face1f84e34878ac98afc

Analysis

Target

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Size

71KB
MD5

10aa058a3ac49e016cad7987b8e09886
SHA1

cca6682330a819592c3b1ea0448ceb4e141593dc
SHA256

6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db
SHA512

f115fb62b1ca5e18f6340d42ff4393e2b175917312ae1cc14e7a6a9322cf8adaf22457bc8213e2baafdc2cb19d5db1e5a9c003155cbf142d5a08604495e22f6e

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	1924	WerFault.exe	26

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
640	WerFault.exe
640	WerFault.exe
640	WerFault.exe
640	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
640	WerFault.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeBackupPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeDebugPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: 36	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeImpersonatePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeIncBasePriorityPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeIncreaseQuotaPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: 33	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeManageVolumePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeProfSingleProcessPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeRestorePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeSecurityPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeSystemProfilePrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeTakeOwnershipPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeShutdownPrivilege	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe
Token: SeDebugPrivilege	640	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	28
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	28
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	28
PID 1924 wrote to memory of 640	1924	6d4712df42ad0982041ef0e2e109ab5718b43830f2966bd9207a7fac3af883db.exe	28

memory/640-60-0x0000000000280000-0x00000000002E0000-memory.dmp

Filesize
384KB

Download
memory/1924-55-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download
memory/1924-56-0x00000000008F5000-0x0000000000906000-memory.dmp

Filesize
68KB

Download
memory/1924-57-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1924-58-0x0000000000906000-0x0000000000907000-memory.dmp

Filesize
4KB

Download