62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda

Analysis

Target

62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe
Size

4KB
MD5

c92ba94df1978603dc92ec0e97f56055
SHA1

49debc4aaa7cc5bc257e01e5c8498acf4c8ab74e
SHA256

62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda
SHA512

ec0240554152ade56cb6a169697c3b5d7c4eab0b4da091c13728ce2ecc6230176cc0546c065629090be138565870fc13450994ac257d9d61ad78296938f49f83

Score

3^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 840	1044	62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe	25
PID 1044 wrote to memory of 840	1044	62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe	25
PID 1044 wrote to memory of 840	1044	62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
840	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1044	WerFault.exe	23

C:\Users\Admin\AppData\Local\Temp\62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe
"C:\Users\Admin\AppData\Local\Temp\62e348a281df1a3ef489cb719c3c1a9f3dfddcb774b2f94e2c288e0ae8600eda.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1044 -s 612
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Program crash
  PID:840

memory/840-1-0x0000000001D60000-0x0000000001D71000-memory.dmp

Filesize
68KB

Download
memory/840-2-0x0000000002B20000-0x0000000002B31000-memory.dmp

Filesize
68KB

Download