b2bf5cc24050b609b045aaa7645d9e336147eee99360ec3865cafba0ed671737

Analysis

Target

0319dc03d20abc2a5c7d454d790180fa124c8683b2518863c4ff71294d2a5128~.exe
Size

5KB
MD5

bcaf5027213627916544e5c456b9fd9a
SHA1

c8098798fa629b3f2725198c8c7199f7e5fa6b29
SHA256

b2bf5cc24050b609b045aaa7645d9e336147eee99360ec3865cafba0ed671737
SHA512

ce7681fbc3618b1649eb4b9e0db15c54ca20fa870493359ddda3b188c3411420d15b67ae4a8af6a92edbbfcb5a11f47bacd82803dad3170ca0102b9069f46391

Score

3^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	WerFault.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1820	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	1520	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1820	1520	0319dc03d20abc2a5c7d454d790180fa124c8683b2518863c4ff71294d2a5128~.exe	27
PID 1520 wrote to memory of 1820	1520	0319dc03d20abc2a5c7d454d790180fa124c8683b2518863c4ff71294d2a5128~.exe	27
PID 1520 wrote to memory of 1820	1520	0319dc03d20abc2a5c7d454d790180fa124c8683b2518863c4ff71294d2a5128~.exe	27

C:\Users\Admin\AppData\Local\Temp\0319dc03d20abc2a5c7d454d790180fa124c8683b2518863c4ff71294d2a5128~.exe
"C:\Users\Admin\AppData\Local\Temp\0319dc03d20abc2a5c7d454d790180fa124c8683b2518863c4ff71294d2a5128~.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1520 -s 644
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Program crash
  PID:1820

memory/1820-1-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Filesize
68KB

Download
memory/1820-2-0x0000000002BB0000-0x0000000002BC1000-memory.dmp

Filesize
68KB

Download