9c686bbba644469a2fe639de221469d4bf9eba11c65be9cd0fd246e080d5f5b9

Analysis

Target
MJ 00000178263783400.exe
Size 756KB
Sample220321-hd3d8shfb4
SHA256 9c686bbba644469a2fe639de221469d4bf9eba11c65be9cd0fd246e080d5f5b9
MD5 d119ed414c261fad55fa88b5200d09ef
SHA1 7d6e114e4bd119c96e348647ef8df43ceea92384
SHA512 f13c241f9ef94667ba62e613f22af8728a6fe5fa60b1a682dbddeceb10f3d3234a18f66b63c001dd256183541afb66111e1d168fae16c4994f5017c93229f398
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	628	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	MJ 00000178263783400.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 848	628	MJ 00000178263783400.exe	27
PID 628 wrote to memory of 848	628	MJ 00000178263783400.exe	27
PID 628 wrote to memory of 848	628	MJ 00000178263783400.exe	27
PID 628 wrote to memory of 848	628	MJ 00000178263783400.exe	27

C:\Users\Admin\AppData\Local\Temp\MJ 00000178263783400.exe
"C:\Users\Admin\AppData\Local\Temp\MJ 00000178263783400.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 87976
  2⤵
  - Program crash
  PID:848

memory/628-54-0x0000000000920000-0x00000000009E6000-memory.dmp

Download

memory/628-55-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Download

memory/628-56-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download