10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2

Analysis

Target
10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2.exe
Size 5.7MB
Sample201110-bd8yz2gpgn
SHA256 10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2
MD5 c3a20f1d066a35140a619b1b0eec6670
SHA1 9eebcb1a455880277ddcccfd793fe9e24c3120c2
SHA512 e645671902cbc8bfbc8d3e4d2a20ff1437f228c3ea7924c9e9513e5e0a087d6b252e3c1ca6470184889d336b1aeff9b1be9f81c220d49123b7d74f5803ef03f8
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	1688	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1200	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1200	1688	10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2.exe	27
PID 1688 wrote to memory of 1200	1688	10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2.exe	27
PID 1688 wrote to memory of 1200	1688	10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2.exe	27

C:\Users\Admin\AppData\Local\Temp\10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2.exe
"C:\Users\Admin\AppData\Local\Temp\10ebea9cec6f1491782819a6c20ff7b0ef3cd11ea9e190489f459bf2d6d4e7b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1688 -s 72
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1200

memory/1200-1-0x0000000001E00000-0x0000000001E11000-memory.dmp

Download

memory/1200-2-0x0000000002A40000-0x0000000002A51000-memory.dmp

Download