d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81

Analysis

Target

d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe
Size

105KB
MD5

f41ca96be6bfbd75c033a11c13f1de64
SHA1

abc54df72498ba115a02d0a5fce7a404ca3ae8d9
SHA256

d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81
SHA512

191aa2a4b67435d918cb42463ce2f662568b2c09b3099203260915853177e63de8a36883bf8a2ea15b7ff13b6188377c064d26eb3499868001b08583a6888468

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1032 WerFault.exe d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2040 WerFault.exe

pid	pid_target	process	target process
2040	1032	WerFault.exe	d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe

description	pid	process
Token: SeDebugPrivilege	2040	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe

description	pid	process	target process
PID 1032 wrote to memory of 2040	1032	d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe	WerFault.exe
PID 1032 wrote to memory of 2040	1032	d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe	WerFault.exe
PID 1032 wrote to memory of 2040	1032	d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe	WerFault.exe
PID 1032 wrote to memory of 2040	1032	d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe
"C:\Users\Admin\AppData\Local\Temp\d91d842ca63f9a74ce1f49147e041d729af9e4775a4b1f18e7779a5f2dbe6b81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

memory/2040-0-0x0000000000000000-mapping.dmp

Download
memory/2040-1-0x0000000001F90000-0x0000000001FA1000-memory.dmp

Filesize
68KB

Download
memory/2040-2-0x0000000002420000-0x0000000002431000-memory.dmp

Filesize
68KB

Download