80c4ae2cbe5de2ff528e2f6b6ab2cc5a1a9c76c316f2fc70cfcd13cc10b1dcda

Resubmissions

06-07-2021 11:38

05-07-2021 22:00

Target

MsMpEng_dump.exe
Size

136KB
MD5

62eba498db41404a032e49a0276fad83
SHA1

a929021015083b17882a7b56a3037b5184eec705
SHA256

80c4ae2cbe5de2ff528e2f6b6ab2cc5a1a9c76c316f2fc70cfcd13cc10b1dcda
SHA512

122dd73643179ae867d3d267a844209db2ac870eaa682dd895c7da03d75f02df2b3c277c7be75b0bc1b77146aa7f64937f75271029f45a974f669f54cd138563

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2016 1916 WerFault.exe MsMpEng_dump.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

2016 WerFault.exe
2016 WerFault.exe
2016 WerFault.exe
2016 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2016 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2016 WerFault.exe

pid	pid_target	process	target process
2016	1916	WerFault.exe	MsMpEng_dump.exe

pid	process
2016	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2016	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

MsMpEng_dump.exe

description	pid	process	target process
PID 1916 wrote to memory of 2016	1916	MsMpEng_dump.exe	WerFault.exe
PID 1916 wrote to memory of 2016	1916	MsMpEng_dump.exe	WerFault.exe
PID 1916 wrote to memory of 2016	1916	MsMpEng_dump.exe	WerFault.exe
PID 1916 wrote to memory of 2016	1916	MsMpEng_dump.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MsMpEng_dump.exe
"C:\Users\Admin\AppData\Local\Temp\MsMpEng_dump.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916

memory/2016-59-0x0000000000000000-mapping.dmp

Download
memory/2016-60-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download