bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4

Analysis

Target

bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe
Size

586KB
MD5

effcf5955cebbeb7a830ca594140c3b6
SHA1

e7fef6117f1b2aa096c7d8c1eefc5b95a5ff98b3
SHA256

bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4
SHA512

549ec0a6cf89507510002b74ded5bbb239e5d40d744acb184e2378b83d7b4079468e8b0653408f71f36df945425e19eff37de3b6630d05c13192474490746d6b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

612 1116 WerFault.exe bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

612 WerFault.exe
612 WerFault.exe
612 WerFault.exe
612 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 612 WerFault.exe

pid	pid_target	process	target process
612	1116	WerFault.exe	bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe

description	pid	process
Token: SeDebugPrivilege	612	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe

description	pid	process	target process
PID 1116 wrote to memory of 612	1116	bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe	WerFault.exe
PID 1116 wrote to memory of 612	1116	bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe	WerFault.exe
PID 1116 wrote to memory of 612	1116	bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe	WerFault.exe
PID 1116 wrote to memory of 612	1116	bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe
"C:\Users\Admin\AppData\Local\Temp\bf918a307f306ab901fe1846aee351aa18e51920d45a908339a5eb95a6466ca4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

memory/612-61-0x0000000000000000-mapping.dmp

Download
memory/612-62-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1116-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1116-57-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download
memory/1116-58-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1116-59-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/1116-60-0x0000000004240000-0x0000000004284000-memory.dmp

Filesize
272KB

Download