8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb

Analysis

Target

8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb.exe
Size

5KB
MD5

a4b786f0e8fbe5f42af3e29838b3c41e
SHA1

ea818cf3caf4589067a56769e6affb34903879ff
SHA256

8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb
SHA512

98c052dfc986f169e22fdc859610e712cd4276fff5d83664d2c9e26d63e46bc6afa6522bf8ddb64d73d441fb3379c720bfd6502507e2531fd5aa4144a7ead514

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	1492	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 532	1492	8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb.exe	25
PID 1492 wrote to memory of 532	1492	8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb.exe	25
PID 1492 wrote to memory of 532	1492	8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	532	WerFault.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
532	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb.exe
"C:\Users\Admin\AppData\Local\Temp\8e929337cda31bcbacba82cc34389646bde95f5738842c90a46d6c06fab26dfb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1492 -s 612
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:532

memory/532-1-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Filesize
68KB

Download
memory/532-2-0x0000000002A10000-0x0000000002A21000-memory.dmp

Filesize
68KB

Download
memory/532-3-0x0000000002A10000-0x0000000002A21000-memory.dmp

Filesize
68KB

Download