347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100

Analysis

Target

347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100.exe
Size

711KB
MD5

3bdeb4da08d401958302aca956ebbba6
SHA1

7d9bbc2b3c5e95bb58caaf214600d2b8d1a680c1
SHA256

347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100
SHA512

ddff1544dd3013a1f9839b3bdcc2f8d566df12a56ebaf398f38e1e8b7b1da93dba1aa77fc8bf0c4941eeccd0ca1ed34ed4c1a4ca263513f4c8ff2bdf1da2d8bb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	1920	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
844	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	844	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 844	1920	347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100.exe	25
PID 1920 wrote to memory of 844	1920	347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100.exe	25
PID 1920 wrote to memory of 844	1920	347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100.exe	25
PID 1920 wrote to memory of 844	1920	347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100.exe	25

C:\Users\Admin\AppData\Local\Temp\347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100.exe
"C:\Users\Admin\AppData\Local\Temp\347d08938a60bf2d5e7d235718a99f34950c91e4170fd86be1cfe93998a65100.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 176
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:844

memory/844-62-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1920-60-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download