aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b

Analysis

Target

aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe
Size

110KB
MD5

16c9b60c23fb1b6e578f1b2c330a637e
SHA1

8e9f845376867df8cc8675d8a9eaef8fb25d02d0
SHA256

aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b
SHA512

53a321eb8ac8de8951a915043eb88459b642f522a59e8fca80814411d7d7505a5585b3b53b4b2f0f391ebe3a573560e7ae5bf148c1e1b0fb4ac9a522ae244520

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 1124 WerFault.exe aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
1520 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1520 WerFault.exe

pid	pid_target	process	target process
1520	1124	WerFault.exe	aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe

description	pid	process
Token: SeDebugPrivilege	1520	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe

description	pid	process	target process
PID 1124 wrote to memory of 1520	1124	aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe	WerFault.exe
PID 1124 wrote to memory of 1520	1124	aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe	WerFault.exe
PID 1124 wrote to memory of 1520	1124	aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe	WerFault.exe
PID 1124 wrote to memory of 1520	1124	aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe
"C:\Users\Admin\AppData\Local\Temp\aa8c776ec59e6c777b178a2836c5c20c9cb3e89155b4044c3b96dc1599c3695b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

memory/1520-0-0x0000000000000000-mapping.dmp

Download
memory/1520-1-0x0000000002190000-0x00000000021A1000-memory.dmp

Filesize
68KB

Download
memory/1520-2-0x0000000002640000-0x0000000002651000-memory.dmp

Filesize
68KB

Download