913a8adeb8194c703684e6307c15de82de9e033fa42e9f2025e55ab534eb6dfc

Analysis

Target

msdtc.bin.exe
Size

5.2MB
MD5

ba186e8a8abcbf0ed4fbb5fac6ba5821
SHA1

2ebac954c1941cecefa078ca2fb50f1b9281a3bd
SHA256

46da8d04de493e9858caa01cfadcd8e740be109e379985880fa05f23040f8d68
SHA512

54a14900b16226d4b95148508a54cd3decaadb593c2467e8c41e32ea1a167dd25e7b8dc5ec3021bd07a3d3f11265b9b54ce301d73ffe5e0a2ea328113b5ab158

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

796 1044 WerFault.exe msdtc.bin.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

796 WerFault.exe
796 WerFault.exe
796 WerFault.exe
796 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

796 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 796 WerFault.exe

pid	pid_target	process	target process
796	1044	WerFault.exe	msdtc.bin.exe

pid	process
796	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	796	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

msdtc.bin.exe

description	pid	process	target process
PID 1044 wrote to memory of 796	1044	msdtc.bin.exe	WerFault.exe
PID 1044 wrote to memory of 796	1044	msdtc.bin.exe	WerFault.exe
PID 1044 wrote to memory of 796	1044	msdtc.bin.exe	WerFault.exe
PID 1044 wrote to memory of 796	1044	msdtc.bin.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\msdtc.bin.exe
"C:\Users\Admin\AppData\Local\Temp\msdtc.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

memory/796-0-0x0000000000000000-mapping.dmp

Download
memory/796-1-0x0000000002120000-0x0000000002131000-memory.dmp

Filesize
68KB

Download
memory/796-2-0x0000000002120000-0x0000000002131000-memory.dmp

Filesize
68KB

Download
memory/796-6-0x0000000002560000-0x0000000002571000-memory.dmp

Filesize
68KB

Download