ee03a9ea2fc9946431e87d056a6c4730a218dbc5107f8046191e92b9d9777002

Analysis

Target

aEhOSk9msVN2CIr.exe
Size

550KB
MD5

9c0b7fefa4295e2c9d665fa48d76db43
SHA1

e98aacfe9040022c3fe0796fabc41271a3edd410
SHA256

ee03a9ea2fc9946431e87d056a6c4730a218dbc5107f8046191e92b9d9777002
SHA512

6d47251d318fa720d81463c493124de621b1ac2eb535ba8e0faa706ef96fe924531920793b9715be200ea1ff9b6000c571d1534c86dab1f6dc42c54f29b0deab

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

552 1708 WerFault.exe aEhOSk9msVN2CIr.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

552 WerFault.exe
552 WerFault.exe
552 WerFault.exe
552 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 552 WerFault.exe

pid	pid_target	process	target process
552	1708	WerFault.exe	aEhOSk9msVN2CIr.exe

description	pid	process
Token: SeDebugPrivilege	552	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aEhOSk9msVN2CIr.exe

description	pid	process	target process
PID 1708 wrote to memory of 552	1708	aEhOSk9msVN2CIr.exe	WerFault.exe
PID 1708 wrote to memory of 552	1708	aEhOSk9msVN2CIr.exe	WerFault.exe
PID 1708 wrote to memory of 552	1708	aEhOSk9msVN2CIr.exe	WerFault.exe
PID 1708 wrote to memory of 552	1708	aEhOSk9msVN2CIr.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\aEhOSk9msVN2CIr.exe
"C:\Users\Admin\AppData\Local\Temp\aEhOSk9msVN2CIr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

memory/552-61-0x0000000000000000-mapping.dmp

Download
memory/552-62-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/1708-55-0x0000000001220000-0x0000000001221000-memory.dmp

Filesize
4KB

Download
memory/1708-57-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1708-58-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/1708-59-0x00000000006F0000-0x00000000006F8000-memory.dmp

Filesize
32KB

Download
memory/1708-60-0x0000000005130000-0x00000000051A2000-memory.dmp

Filesize
456KB

Download