4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd

Analysis

Target
PO 35467833(VN).exe
Size 550KB
Sample211202-ktb84adegn
SHA256 4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd
MD5 bdb527c345da49a51e27f2a69c7b7e05
SHA1 fce0a4025c531428178aa6bbc4a7009529703988
SHA512 7c6a3f06781afe1af816ad72a99fa8e8a904b70d6373ca9828546768cad636212bce248213326c8f7eb0fddf1ee41a44b8fe57563b49696411ea698f8b62ecc6
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	1092	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	28
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	28
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	28
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	28

C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe
"C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 664
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1200

memory/1092-55-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/1092-57-0x0000000074F61000-0x0000000074F63000-memory.dmp

Download

memory/1092-58-0x0000000004F30000-0x0000000004F31000-memory.dmp

Download

memory/1092-59-0x0000000000450000-0x0000000000458000-memory.dmp

Download

memory/1092-60-0x0000000005070000-0x00000000050E5000-memory.dmp

Download

memory/1200-62-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download