69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9

Analysis

Target

69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9.exe
Size

5KB
MD5

48fbe04ca3f226bdb936773d44c03944
SHA1

5357f048dcf993b9eba56484563158a3fdfaaffa
SHA256

69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9
SHA512

403d409c8ffc3eb8d8a053e617fb638f13ffe05242c44a864bc2df7732f94c1835a1bf9a46ee39f0a8b90fb2a7440ea3d45d6bed0712220ef7f8dca8ce166169

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
480	1456	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 480	1456	69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9.exe	25
PID 1456 wrote to memory of 480	1456	69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9.exe	25
PID 1456 wrote to memory of 480	1456	69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	480	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9.exe
"C:\Users\Admin\AppData\Local\Temp\69896bcd1041c6cc5a3caf6e1e4fd2be566bff0e0f3d3154a0e45ab00cb217f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1456 -s 608
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:480

memory/480-1-0x0000000001F20000-0x0000000001F31000-memory.dmp

Filesize
68KB

Download
memory/480-2-0x0000000002BC0000-0x0000000002BD1000-memory.dmp

Filesize
68KB

Download