9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177

Analysis

Target
9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177.exe
Size 5.7MB
Sample201110-wkxpagdb2n
SHA256 9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177
MD5 2f5d995522c8e50e0f20936065fad246
SHA1 c771388e672498c50872f2768001b3ba94920ee3
SHA512 2c6b7bb802755c0355744bf218c6667301f0c226106d481fed458fd31d635e52d5b91edf4d23c009d259af8c7b770408d5b8a70be8d5eafb7c636fcbff424509
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1668	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1948	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1948	1668	9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177.exe	27
PID 1668 wrote to memory of 1948	1668	9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177.exe	27
PID 1668 wrote to memory of 1948	1668	9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177.exe	27

C:\Users\Admin\AppData\Local\Temp\9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177.exe
"C:\Users\Admin\AppData\Local\Temp\9f891efa9cda7058c4d6085e54bae71ca35cb206adf9e25cd4ffa9510c420177.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1668 -s 72
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1948

memory/1948-1-0x0000000001DD0000-0x0000000001DE1000-memory.dmp

Download

memory/1948-2-0x0000000002BC0000-0x0000000002BD1000-memory.dmp

Download