83ac6dd25820e1b6b826c2d52a28bf71506fec4f8320d4f51f3a0cfd739502f3

Resubmissions

16-09-2021 19:52

02-08-2021 22:19

Target

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
Size

67KB
MD5

e6b0276bc3f541d8ff1ebb1b59c8bd29
SHA1

295de44a0adbef57c51458978ccd71437aff0bf1
SHA256

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720
SHA512

cdc851b9a7dc396384cbd69353f4e594cb3ac80679abfaa9ebf7bf849bca1b2e2c233c9634239e4aaa4e7f02a2af096733bef1b760ae0e6d660918217cecdcee

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 1244 WerFault.exe daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1664 WerFault.exe
1664 WerFault.exe
1664 WerFault.exe
1664 WerFault.exe
1664 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1664 WerFault.exe

pid	pid_target	process	target process
1664	1244	WerFault.exe	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe

description	pid	process
Token: SeDebugPrivilege	1664	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe

description	pid	process	target process
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	WerFault.exe
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	WerFault.exe
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	WerFault.exe
PID 1244 wrote to memory of 1664	1244	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
"C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244

memory/1664-53-0x0000000000000000-mapping.dmp

Download
memory/1664-54-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000000310000-0x0000000000324000-memory.dmp

Filesize
80KB

Download