33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b

Resubmissions

09/12/2021, 17:57

06/12/2021, 09:45

22/11/2021, 13:35

Target

2.exe
Size

177KB
MD5

20478d2d2b86e6c8c9da84af39fd652b
SHA1

f9c926efee370218d0d82dd75e703f46355e6018
SHA256

33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b
SHA512

a348e4d5245b6aff3242f02f66415874a6380fa26740ed18ff2e995a87a386acc2e93182066abc3d6e7dc253909ed79099db70209ca38f779adb7fe67c78b613

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	1116	WerFault.exe	10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1516	1116	2.exe	27
PID 1116 wrote to memory of 1516	1116	2.exe	27
PID 1116 wrote to memory of 1516	1116	2.exe	27

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1116 -s 116
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1516

memory/1516-56-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

Filesize
8KB

Download
memory/1516-57-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download