055dca003a76ab4d3701f2351d9298949f8f2df0e4aba4a68bc76f90a2e1225b

Analysis

Target
fraps.exe
Size 519KB
Sample210530-ync14t17ya
SHA256 055dca003a76ab4d3701f2351d9298949f8f2df0e4aba4a68bc76f90a2e1225b
MD5 008769c620b804d401393fc5721bf34f
SHA1 9eda95ab88e51e339f7bdce1512235be7cf57414
SHA512 5bc440aab28726dec7fa9a92b0baafe217143cf2570a7a47a475d03fbb53f65d82170b716ac835ec758e41dacdf787cf53ec698ef42629d244b54868f7705ab1
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	1696	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
928	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 928	1696	fraps.exe	29
PID 1696 wrote to memory of 928	1696	fraps.exe	29
PID 1696 wrote to memory of 928	1696	fraps.exe	29
PID 1696 wrote to memory of 928	1696	fraps.exe	29

C:\Users\Admin\AppData\Local\Temp\fraps.exe
"C:\Users\Admin\AppData\Local\Temp\fraps.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 324
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:928

memory/1696-59-0x0000000075211000-0x0000000075213000-memory.dmp

Download

memory/1696-60-0x00000000023A0000-0x00000000023C0000-memory.dmp

Download

memory/1696-61-0x0000000000310000-0x0000000000311000-memory.dmp

Download