1bde9be8d9036fd9d22b327c9a260d96dbc3e5e805d7836b826df30e2595113f

Analysis

Target

1bde9be8d9036fd9d22b327c9a260d96dbc3e5e805d7836b826df30e2595113f.exe
Size

577KB
MD5

f88c1c3b39298c011ff88b940e80e948
SHA1

a0e9eebbf2dcf14c94d2b3c32eaef5d8192b654f
SHA256

1bde9be8d9036fd9d22b327c9a260d96dbc3e5e805d7836b826df30e2595113f
SHA512

29e722f09e546489aaad17f86c5d9d940bf493094c32f36457467c646eccf0a7b35afd88c0064ec9f8ebe3abb12cbcc547fe6016b3f4e1032cc4c5ce855aa708

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3608 2548 WerFault.exe 1bde9be8d9036fd9d22b327c9a260d96dbc3e5e805d7836b826df30e2595113f.exe

pid	pid_target	process	target process
3608	2548	WerFault.exe	1bde9be8d9036fd9d22b327c9a260d96dbc3e5e805d7836b826df30e2595113f.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3608 WerFault.exe
Token: SeBackupPrivilege 3608 WerFault.exe
Token: SeDebugPrivilege 3608 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1bde9be8d9036fd9d22b327c9a260d96dbc3e5e805d7836b826df30e2595113f.exe
"C:\Users\Admin\AppData\Local\Temp\1bde9be8d9036fd9d22b327c9a260d96dbc3e5e805d7836b826df30e2595113f.exe"
1⤵
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 1188
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608

memory/2548-115-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/2548-117-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/2548-118-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/2548-119-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/2548-120-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/2548-121-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/2548-122-0x0000000005370000-0x000000000540C000-memory.dmp

Filesize
624KB

Download
memory/2548-123-0x0000000002C90000-0x0000000002C9E000-memory.dmp

Filesize
56KB

Download