83ac6dd25820e1b6b826c2d52a28bf71506fec4f8320d4f51f3a0cfd739502f3

Resubmissions

16-09-2021 19:52

02-08-2021 22:19

Target

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
Size

67KB
MD5

e6b0276bc3f541d8ff1ebb1b59c8bd29
SHA1

295de44a0adbef57c51458978ccd71437aff0bf1
SHA256

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720
SHA512

cdc851b9a7dc396384cbd69353f4e594cb3ac80679abfaa9ebf7bf849bca1b2e2c233c9634239e4aaa4e7f02a2af096733bef1b760ae0e6d660918217cecdcee

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	1936	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1060	1936	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25
PID 1936 wrote to memory of 1060	1936	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25
PID 1936 wrote to memory of 1060	1936	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25
PID 1936 wrote to memory of 1060	1936	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25

C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
"C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060

memory/1060-61-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1060-62-0x00000000002B0000-0x00000000002C4000-memory.dmp

Filesize
80KB

Download