7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372

Analysis

Target

7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe
Size

35KB
MD5

957cb1fbad2e60e795f2ece90ef13ba1
SHA1

476e9ebadd00d573ec11621285d21caebf5be249
SHA256

7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372
SHA512

c32701784ffd2be3a38643f18d9b2bc28573f03323130ab0821cad5d892c06c58da30304481cebe31b0bbd4955220b818e668b7b677bbfb21830a1c0bdee349a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	748	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1916	748	7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe	25
PID 748 wrote to memory of 1916	748	7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe	25
PID 748 wrote to memory of 1916	748	7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe	25
PID 748 wrote to memory of 1916	748	7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe	25

C:\Users\Admin\AppData\Local\Temp\7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe
"C:\Users\Admin\AppData\Local\Temp\7d749fb13a8a26f61fa63038e72167b1806199f3a77dc1540832bf6d8bfed372.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 48
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916

memory/1916-1-0x0000000002040000-0x0000000002051000-memory.dmp

Filesize
68KB

Download
memory/1916-2-0x0000000002620000-0x0000000002631000-memory.dmp

Filesize
68KB

Download