Behavioral Report

Analysis

Score

3^/10

Program crash ⋅ 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1628 1684 WerFault.exe WSHSetup[1].exe
Suspicious behavior: EnumeratesProcesses ⋅ 5 IoCs

Processes:

WerFault.exe

pid process

1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1628 WerFault.exe

pid	pid_target	process	target process
1628	1684	WerFault.exe	WSHSetup[1].exe

description	pid	process
Token: SeDebugPrivilege	1628	WerFault.exe

Suspicious use of WriteProcessMemory ⋅ 4 IoCs

Processes:

WSHSetup[1].exe

description	pid	process	target process
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00