86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5

Analysis

Target

86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe
Size

337KB
MD5

7ff711fce0553fa21e4e305253d2018c
SHA1

f06a20b3b4051b1a04282ac6f902d5f3a7263a61
SHA256

86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5
SHA512

714e766e57424c693f24012044b582c681582cc86e65f6b22757baca0613a3f2a3a4d5c7766a8fde57a75fe3614fd21f9259f5ea5b1334064aa6fcd746f87a0a

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 680 WerFault.exe 86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1476 WerFault.exe
1476 WerFault.exe
1476 WerFault.exe
1476 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1476 WerFault.exe

pid	pid_target	process	target process
1476	680	WerFault.exe	86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe

description	pid	process
Token: SeDebugPrivilege	1476	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe

description	pid	process	target process
PID 680 wrote to memory of 1476	680	86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe	WerFault.exe
PID 680 wrote to memory of 1476	680	86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe	WerFault.exe
PID 680 wrote to memory of 1476	680	86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe	WerFault.exe
PID 680 wrote to memory of 1476	680	86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe
"C:\Users\Admin\AppData\Local\Temp\86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 664
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1476

memory/680-55-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/680-57-0x0000000075461000-0x0000000075463000-memory.dmp

Filesize
8KB

Download
memory/680-58-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/680-59-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/680-60-0x00000000046F0000-0x0000000004734000-memory.dmp

Filesize
272KB

Download
memory/1476-61-0x0000000000000000-mapping.dmp

Download
memory/1476-62-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download