daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720

Analysis

Target

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
Size

67KB
MD5

e6b0276bc3f541d8ff1ebb1b59c8bd29
SHA1

295de44a0adbef57c51458978ccd71437aff0bf1
SHA256

daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720
SHA512

cdc851b9a7dc396384cbd69353f4e594cb3ac80679abfaa9ebf7bf849bca1b2e2c233c9634239e4aaa4e7f02a2af096733bef1b760ae0e6d660918217cecdcee

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1800	1208	WerFault.exe	13

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1800	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1800	1208	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25
PID 1208 wrote to memory of 1800	1208	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25
PID 1208 wrote to memory of 1800	1208	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25
PID 1208 wrote to memory of 1800	1208	daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe	25

C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe
"C:\Users\Admin\AppData\Local\Temp\daed41395ba663bef2c52e3d1723ac46253a9008b582bb8d9da9cb0044991720.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1800

memory/1800-61-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/1800-62-0x0000000000B10000-0x0000000000B24000-memory.dmp

Filesize
80KB

Download