eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4

Analysis

Target

5cc6fc2f78336352bac6975edafa2c1a.exe
Size

532KB
MD5

5cc6fc2f78336352bac6975edafa2c1a
SHA1

ccb86ddabe85e1ef348ff3dc5f24577040da5f28
SHA256

eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4
SHA512

2625083acdf607189a41b24f9da874f37714d43318718b2e5291e0fb0651462ffee4c2b11f4f69884f85d222a0d8955158dacad0afb10226c92aa9d9b78b33a7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1892 1524 WerFault.exe 5cc6fc2f78336352bac6975edafa2c1a.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1892 WerFault.exe
1892 WerFault.exe
1892 WerFault.exe
1892 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1892 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1892 WerFault.exe

pid	pid_target	process	target process
1892	1524	WerFault.exe	5cc6fc2f78336352bac6975edafa2c1a.exe

pid	process
1892	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1892	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5cc6fc2f78336352bac6975edafa2c1a.exe

description	pid	process	target process
PID 1524 wrote to memory of 1892	1524	5cc6fc2f78336352bac6975edafa2c1a.exe	WerFault.exe
PID 1524 wrote to memory of 1892	1524	5cc6fc2f78336352bac6975edafa2c1a.exe	WerFault.exe
PID 1524 wrote to memory of 1892	1524	5cc6fc2f78336352bac6975edafa2c1a.exe	WerFault.exe
PID 1524 wrote to memory of 1892	1524	5cc6fc2f78336352bac6975edafa2c1a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe
"C:\Users\Admin\AppData\Local\Temp\5cc6fc2f78336352bac6975edafa2c1a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

memory/1524-55-0x0000000001070000-0x0000000001071000-memory.dmp

Filesize
4KB

Download
memory/1524-57-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1524-58-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/1524-59-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/1524-60-0x0000000000FD0000-0x0000000001014000-memory.dmp

Filesize
272KB

Download
memory/1892-61-0x0000000000000000-mapping.dmp

Download
memory/1892-62-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download