c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721

Analysis

Target

c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe
Size

168KB
MD5

a07d726334600a2595f3ecefc3257e0c
SHA1

d5227e0fa7351637c826e7a0a32ff8fa2c13c6fd
SHA256

c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721
SHA512

ccb614c40fb158cdb40cbec50d5027b4ca1a7dae9a76b9be9ab59789c8af9cac1d792f8d09fd4cbb3dc365c7810bde65af0b83d810246444c2c426c5da487997

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 1320 WerFault.exe c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2008 WerFault.exe
2008 WerFault.exe
2008 WerFault.exe
2008 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2008 WerFault.exe

pid	pid_target	process	target process
2008	1320	WerFault.exe	c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe

description	pid	process
Token: SeDebugPrivilege	2008	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe

description	pid	process	target process
PID 1320 wrote to memory of 2008	1320	c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe	WerFault.exe
PID 1320 wrote to memory of 2008	1320	c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe	WerFault.exe
PID 1320 wrote to memory of 2008	1320	c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe	WerFault.exe
PID 1320 wrote to memory of 2008	1320	c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe
"C:\Users\Admin\AppData\Local\Temp\c4f9ca65e29fd76699bfeed6ccdfd9d7e32a57261e38f73120cef84e20c95721.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

memory/2008-0-0x0000000000000000-mapping.dmp

Download
memory/2008-1-0x0000000000A10000-0x0000000000A21000-memory.dmp

Filesize
68KB

Download
memory/2008-2-0x0000000002610000-0x0000000002621000-memory.dmp

Filesize
68KB

Download