fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57

Resubmissions

24-03-2022 12:21

16-07-2021 18:28

Target

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
Size

788KB
MD5

e2bcd26465f9715da2789febce3bedf7
SHA1

b3bd4d0c84d0751d88eb0343b8e194e499894a98
SHA256

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
SHA512

17f6e5ebe109c652a0dce05de7ada1a0e3811f5558cf084398ece367a82f55fe1fd30797e20434db26a7d4245133e674db928c134c80f6e3297974f291c77219

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 1996 WerFault.exe fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1016 WerFault.exe
1016 WerFault.exe
1016 WerFault.exe
1016 WerFault.exe
1016 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1016 WerFault.exe

pid	pid_target	process	target process
1016	1996	WerFault.exe	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe

description	pid	process
Token: SeDebugPrivilege	1016	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe

description	pid	process	target process
PID 1996 wrote to memory of 1016	1996	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe
PID 1996 wrote to memory of 1016	1996	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe
PID 1996 wrote to memory of 1016	1996	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe
PID 1996 wrote to memory of 1016	1996	fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
"C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 212
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016

memory/1016-62-0x0000000000000000-mapping.dmp

Download
memory/1016-63-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1996-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1996-61-0x0000000013140000-0x0000000013C43000-memory.dmp

Filesize
11.0MB

Download