e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e

Analysis

Target

e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e.exe
Size

2.2MB
MD5

9e609932c59d043565c5d3e5260f571b
SHA1

eaa2e1e2cb6c7b6ec405ffdf204999853ebbd54a
SHA256

e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e
SHA512

34bd135dedd0c55d4fe337966dca8f6b02bda33f7aa67faf2bfd8685ffbb59be946524bfe62ae86fee4d2bbcb771844d29301294719ab3c24071c650dd001e66

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	2028	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1580	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1580	2028	e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e.exe	25
PID 2028 wrote to memory of 1580	2028	e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e.exe	25
PID 2028 wrote to memory of 1580	2028	e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e.exe	25
PID 2028 wrote to memory of 1580	2028	e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e.exe	25

C:\Users\Admin\AppData\Local\Temp\e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e.exe
"C:\Users\Admin\AppData\Local\Temp\e1a7ddbf735d5c1cb9097d7614840c00e5c4d5107fa687c0ab2a2ec8948ef84e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1580

memory/1580-61-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/1580-62-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download