e982e23b9195dcde4e06a12af2096cf9b08d5223873f49474e00e1fabdf818fa

Analysis

Target

8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe
Size

3.6MB
MD5

44a7085f729b68073b5c67bbc66829cc
SHA1

3c03a1c61932bec2b276600ea52bd2803285ec62
SHA256

8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9
SHA512

ab3e0d0fca5cc2ac38c282c2f69663291ff54367061ba15250e9b92f706f245fb353506838304c729da685421c2919e859df2d3aca5d793530d36a8ca0907f04

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1232 648 WerFault.exe 8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1232 WerFault.exe
1232 WerFault.exe
1232 WerFault.exe
1232 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1232 WerFault.exe

pid	pid_target	process	target process
1232	648	WerFault.exe	8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe

description	pid	process
Token: SeDebugPrivilege	1232	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe

description	pid	process	target process
PID 648 wrote to memory of 1232	648	8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe	WerFault.exe
PID 648 wrote to memory of 1232	648	8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe	WerFault.exe
PID 648 wrote to memory of 1232	648	8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe	WerFault.exe
PID 648 wrote to memory of 1232	648	8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe
"C:\Users\Admin\AppData\Local\Temp\8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:648

memory/1232-2-0x0000000000000000-mapping.dmp

Download
memory/1232-3-0x0000000000970000-0x0000000000981000-memory.dmp

Filesize
68KB

Download
memory/1232-4-0x0000000000970000-0x0000000000981000-memory.dmp

Filesize
68KB

Download
memory/1232-6-0x0000000002540000-0x0000000002551000-memory.dmp

Filesize
68KB

Download