ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67

Analysis

Target

ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe
Size

98KB
MD5

5946eea73e2692f395c1b05f99863a43
SHA1

dfd621d5ff5fe5213284c7a876785dfd75d4018e
SHA256

ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67
SHA512

e1832de1b16ad4aea01044591d93149d1c40dd645a27c3a9f69a926632e8c61d0419107de862abf34f2ba344af9903d95d9ad5a54e58c9f713d4058541dc30e2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 1076 WerFault.exe ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
1120 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1120 WerFault.exe

pid	pid_target	process	target process
1120	1076	WerFault.exe	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe

description	pid	process
Token: SeDebugPrivilege	1120	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe

description	pid	process	target process
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	WerFault.exe
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	WerFault.exe
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	WerFault.exe
PID 1076 wrote to memory of 1120	1076	ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe
"C:\Users\Admin\AppData\Local\Temp\ee3647bc00007a5becff10f1bdae0694115bd55fc0d52a6274316146e1258d67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076

memory/1120-0-0x0000000000000000-mapping.dmp

Download
memory/1120-1-0x0000000001FA0000-0x0000000001FB1000-memory.dmp

Filesize
68KB

Download
memory/1120-2-0x0000000002470000-0x0000000002481000-memory.dmp

Filesize
68KB

Download