e36584177d24d335044de0be000a349b79932d3c9b25c7940956c0baf825c9cb

Analysis

Target

H069685744768944.SCR
Size

459KB
MD5

358c6110d2177b53e7e3777c73a609bd
SHA1

03e4a5a30e3209ce44e65b0ad75de8a640a2aba9
SHA256

adae194bf36b9519149adc7c2a3fd19fef3fddb209c81107f19e04a001e4237b
SHA512

e18c39e3940d3fcbf4f19ab84503a6afc976ea3592decbf1d076c5ab844a6bcb1a84d119850991ee37208b0d5006d4a3d313e51493f9c717689b3cd08078839b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 1524 WerFault.exe H069685744768944.SCR
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1660 WerFault.exe
1660 WerFault.exe
1660 WerFault.exe
1660 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1660 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1660 WerFault.exe

pid	pid_target	process	target process
1660	1524	WerFault.exe	H069685744768944.SCR

pid	process
1660	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1660	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

H069685744768944.SCR

description	pid	process	target process
PID 1524 wrote to memory of 1660	1524	H069685744768944.SCR	WerFault.exe
PID 1524 wrote to memory of 1660	1524	H069685744768944.SCR	WerFault.exe
PID 1524 wrote to memory of 1660	1524	H069685744768944.SCR	WerFault.exe
PID 1524 wrote to memory of 1660	1524	H069685744768944.SCR	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\H069685744768944.SCR
"C:\Users\Admin\AppData\Local\Temp\H069685744768944.SCR" /S
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

memory/1524-55-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/1524-57-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1524-58-0x0000000004780000-0x0000000004781000-memory.dmp

Filesize
4KB

Download
memory/1524-59-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1524-60-0x0000000005C50000-0x0000000005CB9000-memory.dmp

Filesize
420KB

Download
memory/1660-61-0x0000000000000000-mapping.dmp

Download
memory/1660-62-0x0000000000560000-0x00000000005DA000-memory.dmp

Filesize
488KB

Download