1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f

Analysis

Target

1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe
Size

202KB
MD5

b0571cacc6330460f1384218b84f1816
SHA1

602eb728a96ea9372a44695ee3ad5100ae8b2543
SHA256

1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f
SHA512

a9f99318f0399cfcb6f55c1f6ecbdb031943c1b31fbcb687afe3dd170c936efa07e03292d60e7532a501ae8797f4a13a8c53611c8e7c0566f2e511e3e2a51e36

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2044 788 WerFault.exe 1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
2044 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2044 WerFault.exe

pid	pid_target	process	target process
2044	788	WerFault.exe	1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe

description	pid	process
Token: SeDebugPrivilege	2044	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe

description	pid	process	target process
PID 788 wrote to memory of 2044	788	1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe	WerFault.exe
PID 788 wrote to memory of 2044	788	1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe	WerFault.exe
PID 788 wrote to memory of 2044	788	1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe	WerFault.exe
PID 788 wrote to memory of 2044	788	1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe
"C:\Users\Admin\AppData\Local\Temp\1e984003f3f04041104c4f4645489879b0ce762c81953ce38803337491d9649f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788

memory/2044-0-0x0000000000000000-mapping.dmp

Download
memory/2044-1-0x0000000002170000-0x0000000002181000-memory.dmp

Filesize
68KB

Download
memory/2044-2-0x0000000002500000-0x0000000002511000-memory.dmp

Filesize
68KB

Download