22253965d84bef16f8026c0e76c58313a3b2fb1ce2aca2bc5b7cbda1f35297c8

Analysis

Target
5d6692d802b1b86acb03a79fda0ecd52.exe
Size 781KB
Sample220424-rt5c7sdghp
SHA256 22253965d84bef16f8026c0e76c58313a3b2fb1ce2aca2bc5b7cbda1f35297c8
MD5 5d6692d802b1b86acb03a79fda0ecd52
SHA1 57b18e2991b333a79a10620c0d4fa73f589a3f5e
SHA512 f98cf7ec1ace9d0ad82a77d27228c03251fc76dc8284cdadd7b5b2e7f35476a57650171a848adc75c11a52c8e3824cc97d46bf7170a8f73d8c4887ccd68ace19
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	1156	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	5d6692d802b1b86acb03a79fda0ecd52.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 836	1156	5d6692d802b1b86acb03a79fda0ecd52.exe	26
PID 1156 wrote to memory of 836	1156	5d6692d802b1b86acb03a79fda0ecd52.exe	26
PID 1156 wrote to memory of 836	1156	5d6692d802b1b86acb03a79fda0ecd52.exe	26
PID 1156 wrote to memory of 836	1156	5d6692d802b1b86acb03a79fda0ecd52.exe	26

C:\Users\Admin\AppData\Local\Temp\5d6692d802b1b86acb03a79fda0ecd52.exe
"C:\Users\Admin\AppData\Local\Temp\5d6692d802b1b86acb03a79fda0ecd52.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 608
  2⤵
  - Program crash
  PID:836

memory/1156-54-0x00000000002E0000-0x00000000003AA000-memory.dmp

Download

memory/1156-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Download