33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b

Resubmissions

09-12-2021 17:57

06-12-2021 09:45

22-11-2021 13:35

Target

2.exe
Size

177KB
MD5

20478d2d2b86e6c8c9da84af39fd652b
SHA1

f9c926efee370218d0d82dd75e703f46355e6018
SHA256

33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b
SHA512

a348e4d5245b6aff3242f02f66415874a6380fa26740ed18ff2e995a87a386acc2e93182066abc3d6e7dc253909ed79099db70209ca38f779adb7fe67c78b613

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1516 1116 WerFault.exe 2.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1516 WerFault.exe
1516 WerFault.exe
1516 WerFault.exe
1516 WerFault.exe
1516 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1516 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1516 WerFault.exe

pid	pid_target	process	target process
1516	1116	WerFault.exe	2.exe

pid	process
1516	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1516	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2.exe

description	pid	process	target process
PID 1116 wrote to memory of 1516	1116	2.exe	WerFault.exe
PID 1116 wrote to memory of 1516	1116	2.exe	WerFault.exe
PID 1116 wrote to memory of 1516	1116	2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1116 -s 116
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1516

memory/1516-55-0x0000000000000000-mapping.dmp

Download
memory/1516-56-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

Filesize
8KB

Download
memory/1516-57-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download