67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7

Analysis

Target

67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe
Size

588KB
MD5

ac514dce9416eb9e4148431016629174
SHA1

b0e1d96605cdc3da995a667a1fdc7189b67bfdcd
SHA256

67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7
SHA512

8c485630cae11e23c5eb790aa061681fe161ea390e07731ea7742a9f029806f43eb432eb08af280b301e889a6b4932ae6c6b436b8d78afb333e5cf0ba8e8907a

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 1608 WerFault.exe 67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2028 WerFault.exe
2028 WerFault.exe
2028 WerFault.exe
2028 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2028 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2028 WerFault.exe

pid	pid_target	process	target process
2028	1608	WerFault.exe	67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe

pid	process
2028	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2028	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe

description	pid	process	target process
PID 1608 wrote to memory of 2028	1608	67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe	WerFault.exe
PID 1608 wrote to memory of 2028	1608	67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe	WerFault.exe
PID 1608 wrote to memory of 2028	1608	67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe	WerFault.exe
PID 1608 wrote to memory of 2028	1608	67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe
"C:\Users\Admin\AppData\Local\Temp\67334c1b7f629c04efefbfb466e5996a425af4a43c07a5ce51d4f142222b0de7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1608

memory/1608-61-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1608-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2028-60-0x0000000000000000-mapping.dmp

Download
memory/2028-63-0x00000000003C0000-0x0000000000420000-memory.dmp

Filesize
384KB

Download