409d082509f1965c92e8be062f7dccb0b9af2458e720460658729468d44fef28

Analysis

Target

1ac9a083e02365f726ee1e704ef5386e.exe
Size

548KB
MD5

1ac9a083e02365f726ee1e704ef5386e
SHA1

4636a5f47b55eef6d39ae6e99e7b90b7bc0e6fd5
SHA256

409d082509f1965c92e8be062f7dccb0b9af2458e720460658729468d44fef28
SHA512

50780d01741b51cad36c661cf9282ba3b5994bd2660997edebafaae18cbc5099a8800b3ae6ca8e8dd2d897318744a87d979ccd6a1c6304ada5e78fc92daf44b7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

612 1628 WerFault.exe 1ac9a083e02365f726ee1e704ef5386e.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

612 WerFault.exe
612 WerFault.exe
612 WerFault.exe
612 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 612 WerFault.exe

pid	pid_target	process	target process
612	1628	WerFault.exe	1ac9a083e02365f726ee1e704ef5386e.exe

description	pid	process
Token: SeDebugPrivilege	612	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ac9a083e02365f726ee1e704ef5386e.exe

description	pid	process	target process
PID 1628 wrote to memory of 612	1628	1ac9a083e02365f726ee1e704ef5386e.exe	WerFault.exe
PID 1628 wrote to memory of 612	1628	1ac9a083e02365f726ee1e704ef5386e.exe	WerFault.exe
PID 1628 wrote to memory of 612	1628	1ac9a083e02365f726ee1e704ef5386e.exe	WerFault.exe
PID 1628 wrote to memory of 612	1628	1ac9a083e02365f726ee1e704ef5386e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1ac9a083e02365f726ee1e704ef5386e.exe
"C:\Users\Admin\AppData\Local\Temp\1ac9a083e02365f726ee1e704ef5386e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

memory/612-61-0x0000000000000000-mapping.dmp

Download
memory/612-62-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1628-55-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/1628-57-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download
memory/1628-58-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/1628-59-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/1628-60-0x0000000005BE0000-0x0000000005C5D000-memory.dmp

Filesize
500KB

Download