e446bd97230671b6e38682ec9f3da7527c18dbd555efc7f27a52d144cf54edcc

Analysis

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1628 1684 WerFault.exe WSHSetup[1].exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
1628 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1628 WerFault.exe

pid	pid_target	process	target process
1628	1684	WerFault.exe	WSHSetup[1].exe

description	pid	process
Token: SeDebugPrivilege	1628	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WSHSetup[1].exe

description	pid	process	target process
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe
PID 1684 wrote to memory of 1628	1684	WSHSetup[1].exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe
"C:\Users\Admin\AppData\Local\Temp\CVWSHSetup[1].bin\WSHSetup[1].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

memory/1628-1-0x0000000000000000-mapping.dmp

Download
memory/1628-2-0x00000000008C0000-0x00000000008D1000-memory.dmp

Filesize
68KB

Download
memory/1628-3-0x00000000008C0000-0x00000000008D1000-memory.dmp

Filesize
68KB

Download
memory/1628-5-0x0000000002710000-0x0000000002721000-memory.dmp

Filesize
68KB

Download
memory/2016-0-0x000007FEF68D0000-0x000007FEF6B4A000-memory.dmp

Filesize
2.5MB

Download