7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748

Resubmissions

06-07-2021 11:29

30-06-2021 05:42

25-06-2021 09:46

Target

7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe
Size

122KB
MD5

2354add5a5f76c25feb03b8d0ed573b1
SHA1

b157ac4a24515f30648853a9e97c81a7b62240f9
SHA256

7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748
SHA512

5663fa484af8c33c2cd5af8fe7694a5b98d9abf2f233a35775401424a0b256bb02b24804de9d316d5bb739b7e2080fe1c5c143805a58b2e185eb88f33bafbbcf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1460 2004 WerFault.exe 7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1460 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1460 WerFault.exe

pid	pid_target	process	target process
1460	2004	WerFault.exe	7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe

pid	process
1460	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1460	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe

description	pid	process	target process
PID 2004 wrote to memory of 1460	2004	7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe	WerFault.exe
PID 2004 wrote to memory of 1460	2004	7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe	WerFault.exe
PID 2004 wrote to memory of 1460	2004	7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe	WerFault.exe
PID 2004 wrote to memory of 1460	2004	7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\7bbfc91293ce881f4f89263a1b64fba067d53226d82d4f7f4eaeb6d490658748.bin.sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

memory/1460-59-0x0000000000000000-mapping.dmp

Download
memory/1460-60-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download