c08897a775845aeff123fd3d6fa4864dc8fe76935c634cdc0299cb3fbff2b922

Analysis

Target
คำสั่ง.exe
Size 818KB
Sample220523-qlm9aadfa4
SHA256 c08897a775845aeff123fd3d6fa4864dc8fe76935c634cdc0299cb3fbff2b922
MD5 c622528f1757f532f1e7ecf239c498f6
SHA1 018eaad3a7c8339af4ecf234fa68eba56245cc14
SHA512 2efd8c7816e970f4b58f5bec62a1ac348f29cdd29e0c008f79f3f36844b1fc445f8a39a65087cafe483c923aba31648593e53c5fbcafb4af083092ea4df73c7c
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	948	WerFault.exe	22

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
948	คำสั่ง.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	คำสั่ง.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1992	948	คำสั่ง.exe	27
PID 948 wrote to memory of 1992	948	คำสั่ง.exe	27
PID 948 wrote to memory of 1992	948	คำสั่ง.exe	27
PID 948 wrote to memory of 1992	948	คำสั่ง.exe	27

C:\Users\Admin\AppData\Local\Temp\คำสั่ง.exe
"C:\Users\Admin\AppData\Local\Temp\คำสั่ง.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 768
  2⤵
  - Program crash
  PID:1992

memory/948-54-0x0000000000040000-0x0000000000112000-memory.dmp

Download

memory/948-55-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/948-56-0x0000000000470000-0x000000000047E000-memory.dmp

Download

memory/948-57-0x0000000005E80000-0x0000000005F02000-memory.dmp

Download

memory/948-58-0x0000000002160000-0x0000000002166000-memory.dmp

Download

memory/948-59-0x0000000002170000-0x0000000002196000-memory.dmp

Download