79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2

Analysis

Target

79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2.exe
Size

8KB
MD5

e32fa93f556ed67aa7d25ab2eed1c02c
SHA1

cdd24ebe72e5041c43bfa21835e674e747678ec8
SHA256

79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2
SHA512

2c4bb7da6fb869971e0d07025d6dcddbc034dd9a31463f23a6ff8a0775e8e8683e7125f9be8019846fe58a44a5b1b1fe0b6aead9ed4ba98752325181f3127338

Score

3^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 280	112	79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2.exe	24
PID 112 wrote to memory of 280	112	79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2.exe	24
PID 112 wrote to memory of 280	112	79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2.exe	24
PID 112 wrote to memory of 280	112	79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	280	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
280	112	WerFault.exe	23

C:\Users\Admin\AppData\Local\Temp\79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2.exe
"C:\Users\Admin\AppData\Local\Temp\79e7a69b5d57d4ae5312dae8ffb6615d41fec9d38fa7cbf0bb37082881cc4fb2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 624
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:280

memory/280-1-0x00000000022F0000-0x0000000002301000-memory.dmp

Filesize
68KB

Download
memory/280-2-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download