77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee

Resubmissions

10-06-2021 05:24

03-06-2021 06:13

01-06-2021 06:25

Target

77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe
Size

132KB
MD5

475044e6128273b86dc2b263daebb11c
SHA1

4e4f60db82c6b992520eb058202e8e88a7b5f7f3
SHA256

77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee
SHA512

9bcee9420a27ef558d33056aee0198c7679bed25b572a17e18454816b8f20844a8db05afde8c8869809d34adc63f1ae1c27e12f6b93d807113b3f4854d637de8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1892 736 WerFault.exe 77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1892 WerFault.exe
1892 WerFault.exe
1892 WerFault.exe
1892 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1892 WerFault.exe

pid	pid_target	process	target process
1892	736	WerFault.exe	77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe

description	pid	process
Token: SeDebugPrivilege	1892	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe

description	pid	process	target process
PID 736 wrote to memory of 1892	736	77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe	WerFault.exe
PID 736 wrote to memory of 1892	736	77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe	WerFault.exe
PID 736 wrote to memory of 1892	736	77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe	WerFault.exe
PID 736 wrote to memory of 1892	736	77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\77e059df69c635724ce4d5ef316e7a96857abfaa8ffbe3462cc580e6eb25afee.bin.sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:736

memory/1892-60-0x0000000000000000-mapping.dmp

Download
memory/1892-61-0x0000000001BD0000-0x0000000001BF1000-memory.dmp

Filesize
132KB

Download