4dbb7c1c75a4553436b03d96efcb5aa20c7c3668cfd6a50cb2c08fff92d5f499

Analysis

Target

reg.exe
Size

421KB
MD5

6054a52000e12227158d5da6410896c5
SHA1

91b7c607dcac68260ca4175d21372796614269d5
SHA256

4dbb7c1c75a4553436b03d96efcb5aa20c7c3668cfd6a50cb2c08fff92d5f499
SHA512

291c418844648231b70e9886563e7d44d1ae9427b16adadee7004a0a121dfe73610fbc9a53dbf7e266b8a2809ced38fff7071403dba18790f05031bddcf864ae

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

568 1320 WerFault.exe reg.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

568 WerFault.exe
568 WerFault.exe
568 WerFault.exe
568 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 568 WerFault.exe

pid	pid_target	process	target process
568	1320	WerFault.exe	reg.exe

description	pid	process
Token: SeDebugPrivilege	568	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

reg.exe

description	pid	process	target process
PID 1320 wrote to memory of 568	1320	reg.exe	WerFault.exe
PID 1320 wrote to memory of 568	1320	reg.exe	WerFault.exe
PID 1320 wrote to memory of 568	1320	reg.exe	WerFault.exe
PID 1320 wrote to memory of 568	1320	reg.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\reg.exe
"C:\Users\Admin\AppData\Local\Temp\reg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320

memory/568-61-0x0000000000000000-mapping.dmp

Download
memory/568-62-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1320-55-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1320-57-0x0000000074F61000-0x0000000074F63000-memory.dmp

Filesize
8KB

Download
memory/1320-58-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/1320-59-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/1320-60-0x0000000004C00000-0x0000000004C58000-memory.dmp

Filesize
352KB

Download