40ba07f9761a6565642d7aae57f2f4622030e33fe80eb46a543446dcb8e3f1ca

Analysis

Target

38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Size

1.6MB
MD5

7feccbef4ed3a323ed763d24d022e4df
SHA1

c6d62240ffd19c94a5f5080d7518b65555eb4fb2
SHA256

38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15
SHA512

ccb1b77974fb1be74fc71f3f6d036aafdf077d214efadd933f8e3f7e4e9e9f4e8915d9d4da31b95a65e15c29429a726aa3d3116fbb4f2b73c3fa95ddc78d22e2

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

776 1884 WerFault.exe 38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe

pid	pid_target	process	target process
776	1884	WerFault.exe	38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1884	38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
Token: SeDebugPrivilege	776	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe

description	pid	process	target process
PID 1884 wrote to memory of 776	1884	38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe	WerFault.exe
PID 1884 wrote to memory of 776	1884	38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe	WerFault.exe
PID 1884 wrote to memory of 776	1884	38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe	WerFault.exe

memory/776-7-0x0000000000000000-mapping.dmp

Download
memory/776-8-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmp

Filesize
8KB

Download
memory/776-9-0x0000000001D40000-0x0000000001D51000-memory.dmp

Filesize
68KB

Download
memory/776-10-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/1884-2-0x000007FEF5910000-0x000007FEF62FC000-memory.dmp

Filesize
9.9MB

Download
memory/1884-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1884-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1884-6-0x000000001B1B0000-0x000000001B1B2000-memory.dmp

Filesize
8KB

Download