b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6

Analysis

Target

b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe
Size

191KB
MD5

77b0bb6da287fce8e8e0f7a6cecf19e1
SHA1

979007ae0a74b0d1191ccf035e3ef4c861dded55
SHA256

b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6
SHA512

73f36543994ef369754d290622997270c619d699b420c660744d68f84518ee5dd6c094496e7c0cf11f6cff111e763cbfd827f1fbfe4ccc1273317992f60467a5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

108 1032 WerFault.exe b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

108 WerFault.exe
108 WerFault.exe
108 WerFault.exe
108 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 108 WerFault.exe

pid	pid_target	process	target process
108	1032	WerFault.exe	b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe

description	pid	process
Token: SeDebugPrivilege	108	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe

description	pid	process	target process
PID 1032 wrote to memory of 108	1032	b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe	WerFault.exe
PID 1032 wrote to memory of 108	1032	b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe	WerFault.exe
PID 1032 wrote to memory of 108	1032	b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe	WerFault.exe
PID 1032 wrote to memory of 108	1032	b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe
"C:\Users\Admin\AppData\Local\Temp\b2097005e9acb8c20765cd74080713d30175b8a859a1db51b56f3fe4f38fc5c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

memory/108-0-0x0000000000000000-mapping.dmp

Download
memory/108-1-0x0000000002020000-0x0000000002031000-memory.dmp

Filesize
68KB

Download
memory/108-2-0x00000000025F0000-0x0000000002601000-memory.dmp

Filesize
68KB

Download