eefecfb998ba82c76a44e86923d550d1c2d2cf24ea5b8b77ff8b25ed7d5d1c7e

Analysis

Target
ad5c25c1f6dfe3b5eabf43447c5a8cf5.exe
Size 219KB
Sample210804-9wdf2s8mwn
SHA256 eefecfb998ba82c76a44e86923d550d1c2d2cf24ea5b8b77ff8b25ed7d5d1c7e
MD5 ad5c25c1f6dfe3b5eabf43447c5a8cf5
SHA1 6734c4a637f1bcaaeca30d3f254c1c205ac2cee2
SHA512 f9c81941113360c781fcca1a3ad845673a06665bbcce37160219302ec8de513a4d17e7773d66ccd85126c08e1ce33dffc235ba4b280fc652949ff23068dd8dc3
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1832	108	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1832	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1832	108	ad5c25c1f6dfe3b5eabf43447c5a8cf5.exe	25
PID 108 wrote to memory of 1832	108	ad5c25c1f6dfe3b5eabf43447c5a8cf5.exe	25
PID 108 wrote to memory of 1832	108	ad5c25c1f6dfe3b5eabf43447c5a8cf5.exe	25
PID 108 wrote to memory of 1832	108	ad5c25c1f6dfe3b5eabf43447c5a8cf5.exe	25

C:\Users\Admin\AppData\Local\Temp\ad5c25c1f6dfe3b5eabf43447c5a8cf5.exe
"C:\Users\Admin\AppData\Local\Temp\ad5c25c1f6dfe3b5eabf43447c5a8cf5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 44
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1832

memory/1832-61-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

Download

memory/1832-62-0x0000000000300000-0x000000000033D000-memory.dmp

Download