044c16cdbc6ec18f58bfecaacf4d4e21150a19d8d10c694c4a4c3085697499a2

Analysis

Target

9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1496 1584 WerFault.exe 9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
1496 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1496 WerFault.exe

pid	pid_target	process	target process
1496	1584	WerFault.exe	9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe

description	pid	process
Token: SeDebugPrivilege	1496	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe

description	pid	process	target process
PID 1584 wrote to memory of 1496	1584	9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe	WerFault.exe
PID 1584 wrote to memory of 1496	1584	9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe	WerFault.exe
PID 1584 wrote to memory of 1496	1584	9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe
"C:\Users\Admin\AppData\Local\Temp\9d1871a7a1315b8c535fa1b673a427640cb4e75b03f1616cdd677345e82dce26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584

memory/1496-5-0x0000000000000000-mapping.dmp

Download
memory/1496-6-0x0000000002040000-0x0000000002051000-memory.dmp

Filesize
68KB

Download
memory/1584-2-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/1584-3-0x0000000001160000-0x0000000001161000-memory.dmp

Filesize
4KB

Download