89fd50a006af9537d9181a8d2dd4872cd29639150ef2ed96a93ed1c3ad1967a4

Analysis

Target
34e5ea61c2e68a2eadb85ce4d80402f7.exe
Size 21KB
Sample220615-ys84bsegf2
SHA256 89fd50a006af9537d9181a8d2dd4872cd29639150ef2ed96a93ed1c3ad1967a4
MD5 34e5ea61c2e68a2eadb85ce4d80402f7
SHA1 b04cd1f68b4bb9ecef160e0af2f1f2b997ece503
SHA512 529045923f7a0bde9cefac9efe52e478a97b6aff36cdb0bb1d1e6396c9dfb581f0399ec1c6fc6e94b9fd1da272a7bffc2be305b61797878ea4857825e5c111f3
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	1260	WerFault.exe	19

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1708	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	26
PID 1260 wrote to memory of 1708	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	26
PID 1260 wrote to memory of 1708	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	26
PID 1260 wrote to memory of 1708	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	26
PID 1260 wrote to memory of 1244	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	28
PID 1260 wrote to memory of 1244	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	28
PID 1260 wrote to memory of 1244	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	28
PID 1260 wrote to memory of 1244	1260	34e5ea61c2e68a2eadb85ce4d80402f7.exe	28

C:\Users\Admin\AppData\Local\Temp\34e5ea61c2e68a2eadb85ce4d80402f7.exe
"C:\Users\Admin\AppData\Local\Temp\34e5ea61c2e68a2eadb85ce4d80402f7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Start-Sleep -Seconds 10;Start-Sleep -Seconds 10;
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 1604
  2⤵
  - Program crash
  PID:1244

memory/1260-54-0x00000000008F0000-0x00000000008FA000-memory.dmp

Download

memory/1708-56-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Download

memory/1708-57-0x0000000071610000-0x0000000071BBB000-memory.dmp

Download

memory/1708-58-0x0000000071610000-0x0000000071BBB000-memory.dmp

Download

memory/1708-59-0x0000000071610000-0x0000000071BBB000-memory.dmp

Download