2f7d37c22e6199d1496f307c676223dda999c136ece4f2748975169b4a48afe5

Resubmissions

21-03-2022 13:01

22-11-2021 17:55

30-07-2021 08:06

Target

88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe
Size

2.2MB
MD5

f49a50f9867fa2be206aef078d2240f3
SHA1

1cc80ad88a022c429f8285d871f48529c6484734
SHA256

2f7d37c22e6199d1496f307c676223dda999c136ece4f2748975169b4a48afe5
SHA512

f76035dd0021712fc6dee8fafafd1c1403c7dc333464fb04ddbddd87f28d5133e234291f821f1d2ccf4f2da8411f5053de2ec59c316f5fe59ae26c6bf66f0b22

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1436	2016	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1436	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1436	2016	88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe	25
PID 2016 wrote to memory of 1436	2016	88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe	25
PID 2016 wrote to memory of 1436	2016	88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe	25
PID 2016 wrote to memory of 1436	2016	88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe	25

C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe
"C:\Users\Admin\AppData\Local\Temp\88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 36
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1436

memory/1436-61-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1436-62-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download