31d0c756511a92e103d90c39fe935fc3f05bcd877de79cdf3a65ca008d91dfdf

Analysis

Target
854F1E97-5DBB-4A87-A566-33D9012B05E2.exe
Size 95KB
Sample220510-gj57msfec6
SHA256 31d0c756511a92e103d90c39fe935fc3f05bcd877de79cdf3a65ca008d91dfdf
MD5 32769875ba094649f97b67a2a2ca0fa8
SHA1 a5d553aee74e4f8ff9df5d240f6b00b6b2423f61
SHA512 894a12cee23975a9d143b55da98be0dcc469ab6b9e59e18a8cd2ce6531afc02479c823de7a467f163e2c6f5a3fbd5d6cc001f6b4754b1a299ed95f0beba46bde
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	1660	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1284	1660	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe	28
PID 1660 wrote to memory of 1284	1660	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe	28
PID 1660 wrote to memory of 1284	1660	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe	28
PID 1660 wrote to memory of 1284	1660	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe	28

C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.exe
"C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 1540
  2⤵
  - Program crash
  PID:1284

memory/1660-54-0x00000000008A0000-0x00000000008BE000-memory.dmp

Download

memory/1660-55-0x00000000765F1000-0x00000000765F3000-memory.dmp

Download

memory/1660-56-0x0000000005AF0000-0x0000000005C4E000-memory.dmp

Download