5be1889c175053fd6c28370aaf406135464dcebb2e5288551753efcd6880ddb1

General

Target

3f4e226811cce4ca41d3b62bb6245087.exe
Size

973KB
MD5

3f4e226811cce4ca41d3b62bb6245087
SHA1

05d263706e1c8c70215bd69ff9d41e994058c9fe
SHA256

5be1889c175053fd6c28370aaf406135464dcebb2e5288551753efcd6880ddb1
SHA512

8a6dfd36fc9bcf54184d575491398cf84b8aed3fa30b94319a250250c7260142e35a62a8f653a3faeef7870c54fdff3630dba360a56df8f3852afa6fda8459c1

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

3f4e226811cce4ca41d3b62bb6245087.exe

description pid process target process

PID 3340 set thread context of 3616 3340 3f4e226811cce4ca41d3b62bb6245087.exe 3f4e226811cce4ca41d3b62bb6245087.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2848 3340 WerFault.exe 3f4e226811cce4ca41d3b62bb6245087.exe

description	pid	process	target process
PID 3340 set thread context of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe

pid	pid_target	process	target process
2848	3340	WerFault.exe	3f4e226811cce4ca41d3b62bb6245087.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

3f4e226811cce4ca41d3b62bb6245087.exeWerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

3f4e226811cce4ca41d3b62bb6245087.exe3f4e226811cce4ca41d3b62bb6245087.exeWerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

3f4e226811cce4ca41d3b62bb6245087.exe3f4e226811cce4ca41d3b62bb6245087.exe

description	pid	process	target process
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3340 wrote to memory of 3616	3340	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3616 wrote to memory of 3976	3616	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3616 wrote to memory of 3976	3616	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe
PID 3616 wrote to memory of 3976	3616	3f4e226811cce4ca41d3b62bb6245087.exe	3f4e226811cce4ca41d3b62bb6245087.exe

C:\Users\Admin\AppData\Local\Temp\3f4e226811cce4ca41d3b62bb6245087.exe
"C:\Users\Admin\AppData\Local\Temp\3f4e226811cce4ca41d3b62bb6245087.exe"
3⤵
PID:3976

memory/3340-115-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/3340-116-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/3340-117-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3340-118-0x0000000005290000-0x000000000578E000-memory.dmp

Filesize
5.0MB

Download
memory/3340-119-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/3340-120-0x0000000005290000-0x000000000578E000-memory.dmp

Filesize
5.0MB

Download
memory/3340-121-0x0000000005290000-0x000000000578E000-memory.dmp

Filesize
5.0MB

Download
memory/3340-122-0x0000000005290000-0x000000000578E000-memory.dmp

Filesize
5.0MB

Download
memory/3340-123-0x0000000009A50000-0x0000000009A51000-memory.dmp

Filesize
4KB

Download
memory/3340-124-0x00000000099B0000-0x0000000009A40000-memory.dmp

Filesize
576KB

Download
memory/3340-125-0x0000000006FC0000-0x0000000006FC3000-memory.dmp

Filesize
12KB

Download
memory/3616-126-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3616-127-0x000000000049914E-mapping.dmp

Download
memory/3616-129-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3616-133-0x0000000005230000-0x00000000052C3000-memory.dmp

Filesize
588KB

Download
memory/3616-132-0x0000000005200000-0x000000000529C000-memory.dmp

Filesize
624KB

Download