4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd

Analysis

Target

4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe
Size

550KB
MD5

bdb527c345da49a51e27f2a69c7b7e05
SHA1

fce0a4025c531428178aa6bbc4a7009529703988
SHA256

4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd
SHA512

7c6a3f06781afe1af816ad72a99fa8e8a904b70d6373ca9828546768cad636212bce248213326c8f7eb0fddf1ee41a44b8fe57563b49696411ea698f8b62ecc6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1812 592 WerFault.exe 4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
1812 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1812 WerFault.exe

pid	pid_target	process	target process
1812	592	WerFault.exe	4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe

description	pid	process
Token: SeDebugPrivilege	1812	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe

description	pid	process	target process
PID 592 wrote to memory of 1812	592	4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe	WerFault.exe
PID 592 wrote to memory of 1812	592	4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe	WerFault.exe
PID 592 wrote to memory of 1812	592	4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe	WerFault.exe
PID 592 wrote to memory of 1812	592	4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe
"C:\Users\Admin\AppData\Local\Temp\4823a9ac448317ca5972eb094f2eec9f1f3b2fda812c0d637e12e2b9240feefd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:592

memory/592-55-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/592-57-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/592-58-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/592-59-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/592-60-0x0000000004FA0000-0x0000000005015000-memory.dmp

Filesize
468KB

Download
memory/1812-61-0x0000000000000000-mapping.dmp

Download
memory/1812-62-0x0000000000790000-0x0000000000820000-memory.dmp

Filesize
576KB

Download