e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4

Analysis

Target

e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe
Size

79KB
MD5

936593e1ba2e1fefc78389ed40ab9d9a
SHA1

dce566c765b39bca870e374c7f973b432a633fb3
SHA256

e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4
SHA512

21d3f5f00be88041ee4839a776ed8e7428bcb1e8172d4c4f9af2a7b782c3f89fc4dd57402dbf77d24664b8a99d2d330dc8b231d9d7037564bbc9276c49633017

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	2012	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2000	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2000	2012	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	27
PID 2012 wrote to memory of 2000	2012	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	27
PID 2012 wrote to memory of 2000	2012	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	27
PID 2012 wrote to memory of 2000	2012	e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe	27

C:\Users\Admin\AppData\Local\Temp\e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe
"C:\Users\Admin\AppData\Local\Temp\e9b24041847844a5d57b033bf0b41dc637eba7664acfb43da5db635ae920a1b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2000

memory/2000-55-0x0000000075C11000-0x0000000075C13000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000000270000-0x00000000002D0000-memory.dmp

Filesize
384KB

Download