6eeefc25fe1d24d3f46b554a31aea357a4cd04635db5c32dfddf28b5446c09d3

Analysis

Target

87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Size

191KB
MD5

197e526a91e1a978dbdac0abc3bfea97
SHA1

32baad03bbcf6c42250a723ab78961fea1fbe8b8
SHA256

87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89
SHA512

aa4241a8d748e5c1fb38bc0ca452e8ff2d1fee2c75654b9bbc3a4261bcf97601e507bbeeda2959e7e1b432f8b3f9ea3142cedf7ef90bda4046b25d82f86db923

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 1996 WerFault.exe 87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1988 WerFault.exe
1988 WerFault.exe
1988 WerFault.exe
1988 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1988 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1988 WerFault.exe

pid	pid_target	process	target process
1988	1996	WerFault.exe	87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe

pid	process
1988	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1988	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe

description	pid	process	target process
PID 1996 wrote to memory of 1988	1996	87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe	WerFault.exe
PID 1996 wrote to memory of 1988	1996	87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe	WerFault.exe
PID 1996 wrote to memory of 1988	1996	87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe	WerFault.exe
PID 1996 wrote to memory of 1988	1996	87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
"C:\Users\Admin\AppData\Local\Temp\87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

memory/1988-55-0x0000000000000000-mapping.dmp

Download
memory/1988-56-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1988-57-0x0000000000270000-0x00000000002A4000-memory.dmp

Filesize
208KB

Download
memory/1996-54-0x0000000001350000-0x0000000001384000-memory.dmp

Filesize
208KB

Download