130ee8bc9ad77f55f3e383e5644d43291e50ada047b1708bad48339d89c6b20f

Analysis

Target

a460c11539913fd882589010f1d8acd2.exe
Size

479KB
MD5

a460c11539913fd882589010f1d8acd2
SHA1

80cfa85456e4d77defdf558ccb611c73de1fbacf
SHA256

130ee8bc9ad77f55f3e383e5644d43291e50ada047b1708bad48339d89c6b20f
SHA512

145385f5efd0fd222c15da26e70f2a81dbb1ff0d28c8d69e6495b66b6ebc2b0a7566d8c8d2146a5d7abbc955f59614913fda8c976ce760520ff8f13ca5825269

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

888 1880 WerFault.exe a460c11539913fd882589010f1d8acd2.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

888 WerFault.exe
888 WerFault.exe
888 WerFault.exe
888 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 888 WerFault.exe

pid	pid_target	process	target process
888	1880	WerFault.exe	a460c11539913fd882589010f1d8acd2.exe

description	pid	process
Token: SeDebugPrivilege	888	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a460c11539913fd882589010f1d8acd2.exe

description	pid	process	target process
PID 1880 wrote to memory of 888	1880	a460c11539913fd882589010f1d8acd2.exe	WerFault.exe
PID 1880 wrote to memory of 888	1880	a460c11539913fd882589010f1d8acd2.exe	WerFault.exe
PID 1880 wrote to memory of 888	1880	a460c11539913fd882589010f1d8acd2.exe	WerFault.exe
PID 1880 wrote to memory of 888	1880	a460c11539913fd882589010f1d8acd2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a460c11539913fd882589010f1d8acd2.exe
"C:\Users\Admin\AppData\Local\Temp\a460c11539913fd882589010f1d8acd2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

memory/888-61-0x0000000000000000-mapping.dmp

Download
memory/888-62-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/1880-55-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1880-57-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/1880-58-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1880-59-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1880-60-0x0000000005B30000-0x0000000005B9B000-memory.dmp

Filesize
428KB

Download