dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb

Resubmissions

18/11/2021, 12:03

08/11/2021, 11:39

Target

dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe
Size

2.2MB
MD5

91655b3f5566a3a01b4c591b90a1a7f4
SHA1

bf498b3c1a785d5b0a314a222ea6a4580a91ec56
SHA256

dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb
SHA512

7a3dd004c9bba6b176cd4cb27fec4d06559e53afc858f4e2217ccc60631b7193bb0abefe668a1238ec5b0116008f341c89330c2e5cdeef63bbab867a64e4779d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	2036	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1080	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1080	2036	dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe	28
PID 2036 wrote to memory of 1080	2036	dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe	28
PID 2036 wrote to memory of 1080	2036	dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe	28
PID 2036 wrote to memory of 1080	2036	dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe	28

C:\Users\Admin\AppData\Local\Temp\dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 36
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1080

memory/1080-56-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download
memory/1080-57-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download