0f808fd3ecf9d722aafeee46b57aad4d07f39c98be6f6148be979ed470cf0a99

Resubmissions

27-01-2024 19:37

27-01-2024 19:36

12-05-2021 15:56

Target

6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe
Size

40KB
MD5

1c33dc87c6fdb80725d732a5323341f9
SHA1

0aea126a9d01fc5faf06314529b4ff06fdc6f8cd
SHA256

6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8
SHA512

50f915e355e66c264d1eaad3bda01034c99ddc8fdc78b03c653ef0ccb4a250e3d892c3b6131fd153c5b73b0ab7c6649c8465ff8dc02f42efb050f8f76906197b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1716	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1992	1716	6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe	25
PID 1716 wrote to memory of 1992	1716	6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe	25
PID 1716 wrote to memory of 1992	1716	6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe	25
PID 1716 wrote to memory of 1992	1716	6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe	25

C:\Users\Admin\AppData\Local\Temp\6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe
"C:\Users\Admin\AppData\Local\Temp\6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 36
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1992

memory/1992-61-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/1992-62-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download