0c803e9046ac715ed9e67641e4aa40f56235f4c3f70b3e65c4ad8a4380322271

Analysis

Target

256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe
Size

8.7MB
MD5

36eb682818f83373a1cf0b45f5b6ecb7
SHA1

4bca1bb8326aa2473845a2d9074ee4c7619f278d
SHA256

0c803e9046ac715ed9e67641e4aa40f56235f4c3f70b3e65c4ad8a4380322271
SHA512

ca864c131dbd099169d3dc93a7aa06710c9f8b8f6716ea351bfe364949087b8d97cd1151c3c1e2c7152b2a223f68dff260f4b4787fcc7ebf37ccd3c399ceef97

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

340 1972 WerFault.exe 256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

340 WerFault.exe
340 WerFault.exe
340 WerFault.exe
340 WerFault.exe
340 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 340 WerFault.exe

pid	pid_target	process	target process
340	1972	WerFault.exe	256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe

description	pid	process
Token: SeDebugPrivilege	340	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe

description	pid	process	target process
PID 1972 wrote to memory of 340	1972	256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe	WerFault.exe
PID 1972 wrote to memory of 340	1972	256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe	WerFault.exe
PID 1972 wrote to memory of 340	1972	256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe	WerFault.exe
PID 1972 wrote to memory of 340	1972	256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe
"C:\Users\Admin\AppData\Local\Temp\256964d4ea3f0d0fbc7a4b7f477bbef5711db05ddc9e3066b313ec0bcf2b569b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 312
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:340

memory/340-2-0x0000000000000000-mapping.dmp

Download
memory/340-3-0x00000000022A0000-0x00000000022B1000-memory.dmp

Filesize
68KB

Download