1df79ab2f458506485c16e48f42bc6aeb291e9b60f4677c1e9bf0b6646bb97bb

Analysis

Target
0iC#33002.exe
Size 671KB
Sample211201-hm3rcsdfc2
SHA256 1df79ab2f458506485c16e48f42bc6aeb291e9b60f4677c1e9bf0b6646bb97bb
MD5 56060e5867436b643b69760825a730ab
SHA1 59ad3f3a99403e6cdff88f21a9c403bb1b5bb7f4
SHA512 b5cafc6053dd413d3c91f2f8e8ab3fc3c581b2f5251c009adff4f32c6d312d02d7ff1165fdcab68eebbf4cf1d31b105ed11b7445224eb0382ce38b87e9f05162
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	1600	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 968	1600	0iC#33002.exe	28
PID 1600 wrote to memory of 968	1600	0iC#33002.exe	28
PID 1600 wrote to memory of 968	1600	0iC#33002.exe	28
PID 1600 wrote to memory of 968	1600	0iC#33002.exe	28

C:\Users\Admin\AppData\Local\Temp\0iC#33002.exe
"C:\Users\Admin\AppData\Local\Temp\0iC#33002.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 668
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968

memory/968-61-0x00000000002B0000-0x0000000000310000-memory.dmp

Download

memory/1600-55-0x00000000012F0000-0x00000000012F1000-memory.dmp

Download

memory/1600-57-0x0000000004B80000-0x0000000004B81000-memory.dmp

Download

memory/1600-58-0x0000000000490000-0x0000000000496000-memory.dmp

Download

memory/1600-59-0x0000000004EF0000-0x0000000004F59000-memory.dmp

Download