05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339

Analysis

Target
05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe
Size 125KB
Sample201018-c81ddkkk96
SHA256 05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339
MD5 2cdbb7e6a0eb5bbd90012e21dd65c318
SHA1 6c201e6cd2c23409dd041cffdaba41cc52a1bc7f
SHA512 0efe295878636b8872f296ee2cec6ac4f43cf74a59e8d02d06a5e3cdc1b2c4c0118d0cb2dd0a88d070ec79945f694caa98eb1b14df75e25556f60b631cf3e25f
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	1088	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	25
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	25
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	25
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	25

C:\Users\Admin\AppData\Local\Temp\05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe
"C:\Users\Admin\AppData\Local\Temp\05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 96
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:540

memory/540-1-0x0000000002040000-0x0000000002051000-memory.dmp

Download

memory/540-2-0x0000000002650000-0x0000000002661000-memory.dmp

Download