b1aea37a6d2fdd3e3d8c646441891848969d92a2f4b88bfc084b4f7a51a88b28

Analysis

Target

Statement.exe
Size

571KB
MD5

9cee10955eb4330bfba8abb81d83cb98
SHA1

8c80ef728fec74d472edbac2fe8f5abb844a86b3
SHA256

b1aea37a6d2fdd3e3d8c646441891848969d92a2f4b88bfc084b4f7a51a88b28
SHA512

7de20802fca5abd5ac7f7a265cdcac97447619f6de039f965d15d4a6c03d23435eaa279e30c895807f93b823130928df9571b3f67db52f3eda80119e9cd8619b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1408 944 WerFault.exe Statement.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1408 WerFault.exe
1408 WerFault.exe
1408 WerFault.exe
1408 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1408 WerFault.exe

pid	pid_target	process	target process
1408	944	WerFault.exe	Statement.exe

description	pid	process
Token: SeDebugPrivilege	1408	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Statement.exe

description	pid	process	target process
PID 944 wrote to memory of 1408	944	Statement.exe	WerFault.exe
PID 944 wrote to memory of 1408	944	Statement.exe	WerFault.exe
PID 944 wrote to memory of 1408	944	Statement.exe	WerFault.exe
PID 944 wrote to memory of 1408	944	Statement.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Statement.exe
"C:\Users\Admin\AppData\Local\Temp\Statement.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:944

memory/944-55-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/944-57-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/944-58-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/944-59-0x0000000000FF0000-0x000000000103B000-memory.dmp

Filesize
300KB

Download
memory/1408-60-0x0000000000000000-mapping.dmp

Download
memory/1408-61-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download