d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a

Analysis

Target

d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a.exe
Size

1.1MB
MD5

7f73e61d4aa8e88b9c01cdf57b3f4c32
SHA1

e9a8cf3ece3ece1be52cda36ffba55851ff8f6ad
SHA256

d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a
SHA512

ccb12690e22b134665f0794425f2a1e49099743e075b2c697303453388dba4f6b41c6446e8e3f328a389183b243f94c6ff5a1ee384403240bf7ba46a19ec6cc3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1056	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1756	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1756	1056	d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a.exe	25
PID 1056 wrote to memory of 1756	1056	d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a.exe	25
PID 1056 wrote to memory of 1756	1056	d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a.exe	25
PID 1056 wrote to memory of 1756	1056	d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a.exe	25

C:\Users\Admin\AppData\Local\Temp\d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a.exe
"C:\Users\Admin\AppData\Local\Temp\d2e7e99b9676576373738837792b8f31f07ba824994ec8e25842257eb4f1e42a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 92
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1756

memory/1756-1-0x0000000001F60000-0x0000000001F71000-memory.dmp

Filesize
68KB

Download
memory/1756-2-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download