f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d

Analysis

Target

f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d.exe
Size

6KB
MD5

22ad5f98cf17f6b82cb73146e6bd2f81
SHA1

8cec6573d2a7776b0c4331dff213e27ab9ccd8b4
SHA256

f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d
SHA512

1aa3f8c29ba4c953910dd0bc424749021a508ed9ce3e510dbd21e4009ccf9de44ffa1f4bd1789cec1857941259d5403d4b38c39e2b3e706395847476fcd482ca

Score

3^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1412	904	f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d.exe	25
PID 904 wrote to memory of 1412	904	f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d.exe	25
PID 904 wrote to memory of 1412	904	f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1412	904	WerFault.exe	23

C:\Users\Admin\AppData\Local\Temp\f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d.exe
"C:\Users\Admin\AppData\Local\Temp\f934c685506a5fc30ba4c63a14f81c2c51863a264c498186234b2edf7d05e51d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 904 -s 500
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Program crash
  PID:1412

memory/1412-1-0x0000000001EA0000-0x0000000001EB1000-memory.dmp

Filesize
68KB

Download
memory/1412-2-0x0000000002C20000-0x0000000002C31000-memory.dmp

Filesize
68KB

Download