bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee

Analysis

Target

bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe
Size

424KB
MD5

9f0e36f04c0365f9fcd5c840a8ba7ea2
SHA1

e9a9229358744196d18e6dd8e2b323a59df56a9b
SHA256

bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee
SHA512

dcbecd0f9c631e45a906a3ffab20c44bf849a26becfe2906811425de59d64301e477dd2cc8d47cb4b9a985810f6f5e4eb58cbde1f8fda5c0ec3aebff987a8695

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 1632 WerFault.exe bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
1504 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1504 WerFault.exe

pid	pid_target	process	target process
1504	1632	WerFault.exe	bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe

description	pid	process
Token: SeDebugPrivilege	1504	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe

description	pid	process	target process
PID 1632 wrote to memory of 1504	1632	bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe	WerFault.exe
PID 1632 wrote to memory of 1504	1632	bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe	WerFault.exe
PID 1632 wrote to memory of 1504	1632	bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe	WerFault.exe
PID 1632 wrote to memory of 1504	1632	bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe
"C:\Users\Admin\AppData\Local\Temp\bca7e01448919541cb01e8c0ab2a7d60840f89be1da7aa297bc5609ffcbe8dee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

memory/1504-0-0x0000000000000000-mapping.dmp

Download
memory/1504-1-0x00000000020E0000-0x00000000020F1000-memory.dmp

Filesize
68KB

Download
memory/1504-2-0x0000000002710000-0x0000000002721000-memory.dmp

Filesize
68KB

Download