4dbb7c1c75a4553436b03d96efcb5aa20c7c3668cfd6a50cb2c08fff92d5f499

Analysis

Target

reg.exe
Size

421KB
MD5

6054a52000e12227158d5da6410896c5
SHA1

91b7c607dcac68260ca4175d21372796614269d5
SHA256

4dbb7c1c75a4553436b03d96efcb5aa20c7c3668cfd6a50cb2c08fff92d5f499
SHA512

291c418844648231b70e9886563e7d44d1ae9427b16adadee7004a0a121dfe73610fbc9a53dbf7e266b8a2809ced38fff7071403dba18790f05031bddcf864ae

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1492 1516 WerFault.exe reg.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1492 WerFault.exe
1492 WerFault.exe
1492 WerFault.exe
1492 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1492 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1492 WerFault.exe

pid	pid_target	process	target process
1492	1516	WerFault.exe	reg.exe

pid	process
1492	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1492	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

reg.exe

description	pid	process	target process
PID 1516 wrote to memory of 1492	1516	reg.exe	WerFault.exe
PID 1516 wrote to memory of 1492	1516	reg.exe	WerFault.exe
PID 1516 wrote to memory of 1492	1516	reg.exe	WerFault.exe
PID 1516 wrote to memory of 1492	1516	reg.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\reg.exe
"C:\Users\Admin\AppData\Local\Temp\reg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516

memory/1492-61-0x0000000000000000-mapping.dmp

Download
memory/1492-62-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1516-55-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/1516-57-0x0000000076A21000-0x0000000076A23000-memory.dmp

Filesize
8KB

Download
memory/1516-58-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/1516-59-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1516-60-0x0000000005170000-0x00000000051C8000-memory.dmp

Filesize
352KB

Download