61ee39a1638079b55aca52d3949c677844e5e26438e06ab9510885ae8fbb664e

Analysis

Target

b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e.exe
Size

329KB
MD5

532abd14ecb22070d712db00cd3703c0
SHA1

502aaa6f9075e1108a96739d899c28f3015e1605
SHA256

b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e
SHA512

716864f25df0a7fb6592ca93848ee68570410ea361b118a71f2daa7baea84d00675ba1b76b36ddb225df827f51188e3480f8e05f65ca6c166e588e1c727fa760

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	1496	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1820	1496	b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e.exe	25
PID 1496 wrote to memory of 1820	1496	b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e.exe	25
PID 1496 wrote to memory of 1820	1496	b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e.exe	25
PID 1496 wrote to memory of 1820	1496	b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e.exe
"C:\Users\Admin\AppData\Local\Temp\b86822b9a8982b84973a2fba76e502fd2b80189a636df117283207f025a59c5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 156
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1820

memory/1820-1-0x00000000020E0000-0x00000000020F1000-memory.dmp

Filesize
68KB

Download
memory/1820-2-0x00000000025B0000-0x00000000025C1000-memory.dmp

Filesize
68KB

Download