6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c

Analysis

Target
6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe
Size 5KB
Sample200709-bqphtphp32
SHA256 6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c
MD5 c6c7b95620352a1df10b834d94c6c03d
SHA1 396d24c5b4e28a6313e11c498df8cb8a8876ac9a
SHA512 4399ce0d7bdef51540da08ed25f00421896df239d306228a58460768b12581d1e79ed5f3bba8da7961b08af9db8bb95e6edeb22abf724ebe94a0debe687434f0
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	880	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 904	880	6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe	25
PID 880 wrote to memory of 904	880	6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe	25
PID 880 wrote to memory of 904	880	6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
904	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe
"C:\Users\Admin\AppData\Local\Temp\6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 880 -s 612
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:904

memory/904-1-0x0000000001E90000-0x0000000001EA1000-memory.dmp

Download

memory/904-2-0x0000000002B00000-0x0000000002B11000-memory.dmp

Download