4a8e5d6a409a60db11f4fc5599d5ff0fb0b4fafcadddbb1281d74ee85ddd1068

Analysis

Target
SecuriteInfo.com.W32.AIDetectNet.01.31336.exe
Size 18KB
Sample220606-yenv8sbcb4
SHA256 4a8e5d6a409a60db11f4fc5599d5ff0fb0b4fafcadddbb1281d74ee85ddd1068
MD5 4c91d98ebb248db3069105605e53ad08
SHA1 d38d6b6e9c74c62de859cbd30208708bd59d0b0a
SHA512 fd5d472511c24f294482687895835212a5182f86861d3b6995bf655db9b023b6869ad2ad3e67c8a039dfc709d69c6cad4640427c749e40f4010e5655f2735f50
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1712	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	SecuriteInfo.com.W32.AIDetectNet.01.31336.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1064	1712	SecuriteInfo.com.W32.AIDetectNet.01.31336.exe	27
PID 1712 wrote to memory of 1064	1712	SecuriteInfo.com.W32.AIDetectNet.01.31336.exe	27
PID 1712 wrote to memory of 1064	1712	SecuriteInfo.com.W32.AIDetectNet.01.31336.exe	27
PID 1712 wrote to memory of 1064	1712	SecuriteInfo.com.W32.AIDetectNet.01.31336.exe	27

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.31336.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.31336.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 1128
  2⤵
  - Program crash
  PID:1064

memory/1712-54-0x0000000001210000-0x000000000121A000-memory.dmp

Download

memory/1712-55-0x0000000075A61000-0x0000000075A63000-memory.dmp

Download