53f330f7212a4e3fb1f942efa722231990af3c986a345d17a3dd451c8762314c

Analysis

Target
SecuriteInfo.com.W32.AIDetectNet.01.13850.exe
Size 22KB
Sample220509-e9yt5scda6
SHA256 53f330f7212a4e3fb1f942efa722231990af3c986a345d17a3dd451c8762314c
MD5 6c9017d94ebba76fa009a022cc47c6f1
SHA1 99dcfa1cfd7995057f018d8787411bda73a47940
SHA512 e78444d16e4be5b8a45cebfbf75fdcb3369d6a64b51934d42e9cca026802b0216594fa5772737f88b54afafa723d6fb44246c5890f29e4518510a3f0d398a390
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	1684	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	SecuriteInfo.com.W32.AIDetectNet.01.13850.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1552	1684	SecuriteInfo.com.W32.AIDetectNet.01.13850.exe	28
PID 1684 wrote to memory of 1552	1684	SecuriteInfo.com.W32.AIDetectNet.01.13850.exe	28
PID 1684 wrote to memory of 1552	1684	SecuriteInfo.com.W32.AIDetectNet.01.13850.exe	28
PID 1684 wrote to memory of 1552	1684	SecuriteInfo.com.W32.AIDetectNet.01.13850.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13850.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13850.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1056
  2⤵
  - Program crash
  PID:1552

memory/1684-54-0x0000000000AB0000-0x0000000000ABC000-memory.dmp

Download

memory/1684-55-0x0000000074F91000-0x0000000074F93000-memory.dmp

Download