4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd

Analysis

Target

PO 35467833(VN).exe
Size

550KB
MD5

bdb527c345da49a51e27f2a69c7b7e05
SHA1

fce0a4025c531428178aa6bbc4a7009529703988
SHA256

4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd
SHA512

7c6a3f06781afe1af816ad72a99fa8e8a904b70d6373ca9828546768cad636212bce248213326c8f7eb0fddf1ee41a44b8fe57563b49696411ea698f8b62ecc6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1200 1092 WerFault.exe PO 35467833(VN).exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1200 WerFault.exe
1200 WerFault.exe
1200 WerFault.exe
1200 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1200 WerFault.exe

pid	pid_target	process	target process
1200	1092	WerFault.exe	PO 35467833(VN).exe

description	pid	process
Token: SeDebugPrivilege	1200	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PO 35467833(VN).exe

description	pid	process	target process
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	WerFault.exe
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	WerFault.exe
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	WerFault.exe
PID 1092 wrote to memory of 1200	1092	PO 35467833(VN).exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe
"C:\Users\Admin\AppData\Local\Temp\PO 35467833(VN).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092

memory/1092-55-0x0000000001360000-0x0000000001361000-memory.dmp

Filesize
4KB

Download
memory/1092-57-0x0000000074F61000-0x0000000074F63000-memory.dmp

Filesize
8KB

Download
memory/1092-58-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/1092-59-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/1092-60-0x0000000005070000-0x00000000050E5000-memory.dmp

Filesize
468KB

Download
memory/1200-61-0x0000000000000000-mapping.dmp

Download
memory/1200-62-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download