c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1

Analysis

Target

c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1.exe
Size

28KB
MD5

30a60930f068380cdebfacff602afdeb
SHA1

54f6151c34baeae2586141cc40b2b28e1e483e81
SHA256

c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1
SHA512

505b1616701bf2255119f236bea7efdbf12561492f53fb3c7e37f75d06621b01290575c57f60f6bc88d4f3fcc3327c43d59d029312572c324c4178d6d65e90c0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1068	876	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1068	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 1068	876	c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1.exe	28
PID 876 wrote to memory of 1068	876	c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1.exe	28
PID 876 wrote to memory of 1068	876	c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1.exe	28
PID 876 wrote to memory of 1068	876	c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1.exe	28

C:\Users\Admin\AppData\Local\Temp\c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1.exe
"C:\Users\Admin\AppData\Local\Temp\c5d3bc2100fafd610181c9983f4d7cfaf861e10f6a3df8282f6a13c2f1113ac1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 132
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1068

memory/1068-55-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download