b1aea37a6d2fdd3e3d8c646441891848969d92a2f4b88bfc084b4f7a51a88b28

Analysis

Target
Statement.exe
Size 571KB
Sample211201-psfmcafba6
SHA256 b1aea37a6d2fdd3e3d8c646441891848969d92a2f4b88bfc084b4f7a51a88b28
MD5 9cee10955eb4330bfba8abb81d83cb98
SHA1 8c80ef728fec74d472edbac2fe8f5abb844a86b3
SHA512 7de20802fca5abd5ac7f7a265cdcac97447619f6de039f965d15d4a6c03d23435eaa279e30c895807f93b823130928df9571b3f67db52f3eda80119e9cd8619b
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	944	WerFault.exe	19

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1408	944	Statement.exe	28
PID 944 wrote to memory of 1408	944	Statement.exe	28
PID 944 wrote to memory of 1408	944	Statement.exe	28
PID 944 wrote to memory of 1408	944	Statement.exe	28

C:\Users\Admin\AppData\Local\Temp\Statement.exe
"C:\Users\Admin\AppData\Local\Temp\Statement.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 664
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1408

memory/944-55-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/944-57-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/944-58-0x0000000000480000-0x0000000000486000-memory.dmp

Download

memory/944-59-0x0000000000FF0000-0x000000000103B000-memory.dmp

Download

memory/1408-61-0x00000000020C0000-0x00000000020C1000-memory.dmp

Download