83ac6dd25820e1b6b826c2d52a28bf71506fec4f8320d4f51f3a0cfd739502f3

Resubmissions

16-09-2021 19:52

02-08-2021 22:19

Target

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
Size

67KB
MD5

e6b0276bc3f541d8ff1ebb1b59c8bd29
SHA1

295de44a0adbef57c51458978ccd71437aff0bf1
SHA256

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720
SHA512

cdc851b9a7dc396384cbd69353f4e594cb3ac80679abfaa9ebf7bf849bca1b2e2c233c9634239e4aaa4e7f02a2af096733bef1b760ae0e6d660918217cecdcee

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1244	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	28
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	28
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	28
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	28

C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
"C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664

memory/1664-54-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000000310000-0x0000000000324000-memory.dmp

Filesize
80KB

Download