05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339

Analysis

Target

05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe
Size

125KB
MD5

2cdbb7e6a0eb5bbd90012e21dd65c318
SHA1

6c201e6cd2c23409dd041cffdaba41cc52a1bc7f
SHA256

05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339
SHA512

0efe295878636b8872f296ee2cec6ac4f43cf74a59e8d02d06a5e3cdc1b2c4c0118d0cb2dd0a88d070ec79945f694caa98eb1b14df75e25556f60b631cf3e25f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

540 1088 WerFault.exe 05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

540 WerFault.exe
540 WerFault.exe
540 WerFault.exe
540 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 540 WerFault.exe

pid	pid_target	process	target process
540	1088	WerFault.exe	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe

description	pid	process
Token: SeDebugPrivilege	540	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe

description	pid	process	target process
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	WerFault.exe
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	WerFault.exe
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	WerFault.exe
PID 1088 wrote to memory of 540	1088	05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe
"C:\Users\Admin\AppData\Local\Temp\05a75635bc6db83ea1ecce6c0572e829db450fbffaae71ed74c51ac867ac2339.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

memory/540-0-0x0000000000000000-mapping.dmp

Download
memory/540-1-0x0000000002040000-0x0000000002051000-memory.dmp

Filesize
68KB

Download
memory/540-2-0x0000000002650000-0x0000000002661000-memory.dmp

Filesize
68KB

Download