99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1

Analysis

Target

99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe
Size

63KB
MD5

c48da412339a14337a3fc2bde400639d
SHA1

7aad8df0b971838a7fc9e6758779c1855123c6c5
SHA256

99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1
SHA512

54ccb28c2a763a0d02aaa20786b3989c4fd59467f86997ce2852cd46a52a88b378deea528e3f625b02f831c7a91f535395cba4a0ccf1e7e287c721f12a10d75b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1652 1156 WerFault.exe 99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1652 WerFault.exe
1652 WerFault.exe
1652 WerFault.exe
1652 WerFault.exe
1652 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1652 WerFault.exe

pid	pid_target	process	target process
1652	1156	WerFault.exe	99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe

description	pid	process
Token: SeDebugPrivilege	1652	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe

description	pid	process	target process
PID 1156 wrote to memory of 1652	1156	99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe	WerFault.exe
PID 1156 wrote to memory of 1652	1156	99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe	WerFault.exe
PID 1156 wrote to memory of 1652	1156	99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe	WerFault.exe
PID 1156 wrote to memory of 1652	1156	99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe
"C:\Users\Admin\AppData\Local\Temp\99a040123078ad1b4b10aaeaa4ae562836d0344e1a7c0c60d632357f889681e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

memory/1652-0-0x0000000000000000-mapping.dmp

Download
memory/1652-1-0x0000000002090000-0x00000000020A1000-memory.dmp

Filesize
68KB

Download
memory/1652-2-0x0000000002580000-0x0000000002591000-memory.dmp

Filesize
68KB

Download