4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea

Analysis

Target

4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe
Size

59KB
MD5

ccb2db4a8a284f62db7002be470ac542
SHA1

b2bdb5ed1ff743117cdf8500a498e247febbb6ec
SHA256

4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea
SHA512

1472e175170bb13173963b479cd90e304b58554908b27caa0e813c47eaf8f85ac3783ce9240cab70a2d6349840ea5069cf44196695f64fdddf1a68ba1ce68f29

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 1684 WerFault.exe 4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1720 WerFault.exe
1720 WerFault.exe
1720 WerFault.exe
1720 WerFault.exe
1720 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1720 WerFault.exe

pid	pid_target	process	target process
1720	1684	WerFault.exe	4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe

description	pid	process
Token: SeDebugPrivilege	1720	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe

description	pid	process	target process
PID 1684 wrote to memory of 1720	1684	4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe	WerFault.exe
PID 1684 wrote to memory of 1720	1684	4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe	WerFault.exe
PID 1684 wrote to memory of 1720	1684	4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe	WerFault.exe
PID 1684 wrote to memory of 1720	1684	4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe
"C:\Users\Admin\AppData\Local\Temp\4fb04b099a37aeae2f58685b8fb08bca298f8f68d5dfc45ceb9fa398e9f109ea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

memory/1684-2-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download
memory/1684-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1720-3-0x0000000000000000-mapping.dmp

Download
memory/1720-5-0x0000000002120000-0x0000000002131000-memory.dmp

Filesize
68KB

Download
memory/1720-6-0x00000000025F0000-0x0000000002601000-memory.dmp

Filesize
68KB

Download
memory/1720-7-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download