7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa

Analysis

Target

7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
Size

590KB
MD5

c239adfb4505f89d70669cec4dc1364c
SHA1

a47b03163f78c21242d0eaff14c0fc2238037659
SHA256

7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa
SHA512

f44f99039fa3b0d2ebade04afdeccc578f578f351f02f67afaa472359eb5c4f3896720dc46b336a7f84e9e42a5865a1b7aff9cb35b2297d7b2fc4b6b600c17d1

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1772 1360 WerFault.exe 7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1772 WerFault.exe
1772 WerFault.exe
1772 WerFault.exe
1772 WerFault.exe
1772 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1772 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1772 WerFault.exe

pid	pid_target	process	target process
1772	1360	WerFault.exe	7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe

pid	process
1772	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1772	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe

description	pid	process	target process
PID 1360 wrote to memory of 1772	1360	7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe	WerFault.exe
PID 1360 wrote to memory of 1772	1360	7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe	WerFault.exe
PID 1360 wrote to memory of 1772	1360	7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe	WerFault.exe
PID 1360 wrote to memory of 1772	1360	7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe
"C:\Users\Admin\AppData\Local\Temp\7f94769671451d108e8e00e38c5b65dc793ec4213069a6d419cfc3116c0191fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

memory/1772-59-0x0000000000000000-mapping.dmp

Download
memory/1772-60-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1772-61-0x0000000000300000-0x0000000000326000-memory.dmp

Filesize
152KB

Download