aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce

Analysis

Target

aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe
Size

204KB
MD5

606ccceadcb12bae910af479f64488ee
SHA1

82940aa9e2b257b697e50789117e2d20ddc8280a
SHA256

aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce
SHA512

beb7ea70ec779e3558023db403bb5d0dbbc8c34ce89833ff9caeae95cdfde72d043b086503cb0db090a9e752026ad2b5666245805cd80ca2f03e183af6740cfe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 1584 WerFault.exe aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1924 WerFault.exe
1924 WerFault.exe
1924 WerFault.exe
1924 WerFault.exe
1924 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1924 WerFault.exe

pid	pid_target	process	target process
1924	1584	WerFault.exe	aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe

description	pid	process
Token: SeDebugPrivilege	1924	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe

description	pid	process	target process
PID 1584 wrote to memory of 1924	1584	aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe	WerFault.exe
PID 1584 wrote to memory of 1924	1584	aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe	WerFault.exe
PID 1584 wrote to memory of 1924	1584	aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe	WerFault.exe
PID 1584 wrote to memory of 1924	1584	aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe
"C:\Users\Admin\AppData\Local\Temp\aed75c1f9c237f679c5ec6eade0403bdab8b4d94d9a51d154a0368dc7cf80fce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

memory/1924-0-0x0000000000000000-mapping.dmp

Download
memory/1924-1-0x0000000001F10000-0x0000000001F21000-memory.dmp

Filesize
68KB

Download
memory/1924-2-0x00000000023A0000-0x00000000023B1000-memory.dmp

Filesize
68KB

Download