a6a4c5aaefa51d2f614a6f21e83b64d63e29fb868c8d410dacf317ad220f774a

Analysis

Target

7e3b08163812d6a9ff4e279058f603e5.exe
Size

388KB
MD5

7e3b08163812d6a9ff4e279058f603e5
SHA1

29a1e69c99fadc447a6958c24e45c71127e88d6b
SHA256

a6a4c5aaefa51d2f614a6f21e83b64d63e29fb868c8d410dacf317ad220f774a
SHA512

7682105ae32834638f77c1c3282bdc3eefc42d922843d12aa346f4c9b2d68269764677b29444953bbff8a9245d2c14416817e879550b170a1921d14366af492b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1372 1412 WerFault.exe 7e3b08163812d6a9ff4e279058f603e5.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1372 WerFault.exe
1372 WerFault.exe
1372 WerFault.exe
1372 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1372 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1372 WerFault.exe

pid	pid_target	process	target process
1372	1412	WerFault.exe	7e3b08163812d6a9ff4e279058f603e5.exe

pid	process
1372	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1372	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7e3b08163812d6a9ff4e279058f603e5.exe

description	pid	process	target process
PID 1412 wrote to memory of 1372	1412	7e3b08163812d6a9ff4e279058f603e5.exe	WerFault.exe
PID 1412 wrote to memory of 1372	1412	7e3b08163812d6a9ff4e279058f603e5.exe	WerFault.exe
PID 1412 wrote to memory of 1372	1412	7e3b08163812d6a9ff4e279058f603e5.exe	WerFault.exe
PID 1412 wrote to memory of 1372	1412	7e3b08163812d6a9ff4e279058f603e5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7e3b08163812d6a9ff4e279058f603e5.exe
"C:\Users\Admin\AppData\Local\Temp\7e3b08163812d6a9ff4e279058f603e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

memory/1372-61-0x0000000000000000-mapping.dmp

Download
memory/1372-62-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1412-55-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1412-57-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1412-58-0x00000000003E0000-0x00000000003E8000-memory.dmp

Filesize
32KB

Download
memory/1412-59-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1412-60-0x0000000005110000-0x000000000515B000-memory.dmp

Filesize
300KB

Download