e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d

Analysis

Target

e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe
Size

558KB
MD5

c132f3aec5547aa6e27b84d86a149355
SHA1

6063e072aacdf4fa903eaee62a33a95a4b4db4d1
SHA256

e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d
SHA512

04200c41848e3e58980489c38f61e3fe3b41cca30d35e9aed48c30d7f4239b6989c6bb6962a9bd91424b2e2c6aac9cc2977de6f7a86f376b046f923ea4caf8af

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1836 392 WerFault.exe e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
1836 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1836 WerFault.exe

pid	pid_target	process	target process
1836	392	WerFault.exe	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe

description	pid	process
Token: SeDebugPrivilege	1836	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe

description	pid	process	target process
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	WerFault.exe
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	WerFault.exe
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	WerFault.exe
PID 392 wrote to memory of 1836	392	e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe
"C:\Users\Admin\AppData\Local\Temp\e010738373d6fa1832f5227678c375950c95ae9a9cd92f8afa0b5dd3d77e796d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:392

memory/1836-0-0x0000000000000000-mapping.dmp

Download
memory/1836-1-0x0000000001EC0000-0x0000000001ED1000-memory.dmp

Filesize
68KB

Download
memory/1836-2-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download