b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a

Analysis

Target

b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe
Size

388KB
MD5

bb97b436d1228b690ae475a8bcfe2cc5
SHA1

37ba5ec064414a74ecf86afba89fc57e627b0193
SHA256

b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a
SHA512

32aff9c8508c2475bc9cf831d8343c013e53833320c19844c9a3c60f0ec3e50cb34d846a187081768c2d8b8f28db165e8e252f5c136f1458b37e1337c9c8b2d6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

588 556 WerFault.exe b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe

pid	pid_target	process	target process
588	556	WerFault.exe	b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exeWerFault.exe

pid	process
556	b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe
588	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

588 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 588 WerFault.exe

pid	process
588	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	588	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe

description	pid	process	target process
PID 556 wrote to memory of 588	556	b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe	WerFault.exe
PID 556 wrote to memory of 588	556	b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe	WerFault.exe
PID 556 wrote to memory of 588	556	b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe	WerFault.exe
PID 556 wrote to memory of 588	556	b2d3143d0778a10d5d03bb9e4d2712a980e2a8ec12d47958a8ab4b3192f4bf6a.exe	WerFault.exe

memory/556-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/556-56-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/556-57-0x00000000004E0000-0x0000000000514000-memory.dmp

Filesize
208KB

Download
memory/588-58-0x0000000000000000-mapping.dmp

Download
memory/588-60-0x0000000000250000-0x00000000002B0000-memory.dmp

Filesize
384KB

Download