bf7fddad958583c75d88fedaba89ef1cd2afb0f0e86fc5c1da404601239ac71e

Analysis

Target
PO_viber_image_2022-03-17_14-44-40-907.exe
Size 7KB
Sample220317-fdwkkshgdj
SHA256 bf7fddad958583c75d88fedaba89ef1cd2afb0f0e86fc5c1da404601239ac71e
MD5 35fc71c43f86657054cf625b1a8df8ad
SHA1 deba2902eee82acb5e6dd951c7ff374fcde4e604
SHA512 ee661fa2c3c3e2402218ff20aebf231e628bcbc76901175b8f402b009ed122a393aaaf2b568a0fa1a9d96120b5852373fe8982e9766c570bb478061ed79fca8d
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1056	1944	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	PO_viber_image_2022-03-17_14-44-40-907.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1056	1944	PO_viber_image_2022-03-17_14-44-40-907.exe	28
PID 1944 wrote to memory of 1056	1944	PO_viber_image_2022-03-17_14-44-40-907.exe	28
PID 1944 wrote to memory of 1056	1944	PO_viber_image_2022-03-17_14-44-40-907.exe	28
PID 1944 wrote to memory of 1056	1944	PO_viber_image_2022-03-17_14-44-40-907.exe	28

C:\Users\Admin\AppData\Local\Temp\PO_viber_image_2022-03-17_14-44-40-907.exe
"C:\Users\Admin\AppData\Local\Temp\PO_viber_image_2022-03-17_14-44-40-907.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1088
  2⤵
  - Program crash
  PID:1056

memory/1944-54-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Download

memory/1944-55-0x00000000749E0000-0x00000000750CE000-memory.dmp

Download

memory/1944-56-0x00000000048B0000-0x00000000048B1000-memory.dmp

Download

memory/1944-57-0x00000000767A1000-0x00000000767A3000-memory.dmp

Download