bf7bc94506eb72daec1d310ba038d9c3b115f145594fd271b80fbe911a8f3964

Resubmissions

30/11/2021, 16:32

30/11/2021, 16:07

Target

bf7bc94506eb72daec1d310ba038d9c3b115f145594fd271b80fbe911a8f3964.exe
Size

2.5MB
MD5

5aa5546c3bffa188f1d9de7fdab67c22
SHA1

7777771aec887896be773c32200515a50e08112a
SHA256

bf7bc94506eb72daec1d310ba038d9c3b115f145594fd271b80fbe911a8f3964
SHA512

45ad38bd0f6da94c9f03d8a8fe63e88ac7f643d2bad613e302413f17d951caacf10c938aa418761984ea4310fe3459222a1b73ba25cd60837dd72ea61e42caad

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 508 created 1900	508	WerFault.exe	68

Program crash 1 IoCs

pid	pid_target	Process	procid_target
508	1900	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	508	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bf7bc94506eb72daec1d310ba038d9c3b115f145594fd271b80fbe911a8f3964.exe
"C:\Users\Admin\AppData\Local\Temp\bf7bc94506eb72daec1d310ba038d9c3b115f145594fd271b80fbe911a8f3964.exe"
1⤵
PID:1900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1900 -s 152
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:508