89eeac2abad61ef22fd914f9c4efaba04ca830d93ab1611c985531ac6d5e8460

Analysis

Target

3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Size

59KB
MD5

c4f1a1b73e4af0fbb63af8ee89a5a7fe
SHA1

5604a48ce74124fb478049976db48197896b6743
SHA256

3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
SHA512

67e6b184b926b1de2fa1d4c429db33b4b4146a0c5eb6929422d6ec161654fc634dce7810a1deb0befdf7d932df1edfc02251d8193272c1d1c713a1df8da32ceb

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1608 2036 WerFault.exe 3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1608 WerFault.exe
1608 WerFault.exe
1608 WerFault.exe
1608 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1608 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1608 WerFault.exe

pid	pid_target	process	target process
1608	2036	WerFault.exe	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe

pid	process
1608	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1608	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe

description	pid	process	target process
PID 2036 wrote to memory of 1608	2036	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe
PID 2036 wrote to memory of 1608	2036	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe
PID 2036 wrote to memory of 1608	2036	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe
PID 2036 wrote to memory of 1608	2036	3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe
"C:\Users\Admin\AppData\Local\Temp\3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 36
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1608

memory/1608-60-0x0000000000000000-mapping.dmp

Download
memory/1608-61-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download
memory/1608-62-0x00000000002B0000-0x00000000002C4000-memory.dmp

Filesize
80KB

Download