91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9

Analysis

Target

MakeSignature.exe
Size

1.5MB
MD5

65050987d23fc2645b902be63251c88e
SHA1

938402d9aa8984218cdf1ce2c7de10d743186522
SHA256

209dd4c6724dafd5efa5547ca539fb77577b3eb53e5b8f49880083e9b5654505
SHA512

028ae64d29f467602f99c37080c1aa2625c236417a1858153431c7196aa549c53521fdb95eb5602adb8d5bf304d6941f0901d3bd13dfd1a9dd09761c2d50bbb4

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 1092 WerFault.exe MakeSignature.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
2032 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2032 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2032 WerFault.exe

pid	pid_target	process	target process
2032	1092	WerFault.exe	MakeSignature.exe

pid	process
2032	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	2032	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

MakeSignature.exe

description	pid	process	target process
PID 1092 wrote to memory of 2032	1092	MakeSignature.exe	WerFault.exe
PID 1092 wrote to memory of 2032	1092	MakeSignature.exe	WerFault.exe
PID 1092 wrote to memory of 2032	1092	MakeSignature.exe	WerFault.exe
PID 1092 wrote to memory of 2032	1092	MakeSignature.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MakeSignature.exe
"C:\Users\Admin\AppData\Local\Temp\MakeSignature.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

memory/1092-60-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

Filesize
8KB

Download
memory/1092-62-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2032-61-0x0000000000000000-mapping.dmp

Download
memory/2032-63-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download