eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4

Analysis

Target

eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe
Size

532KB
MD5

5cc6fc2f78336352bac6975edafa2c1a
SHA1

ccb86ddabe85e1ef348ff3dc5f24577040da5f28
SHA256

eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4
SHA512

2625083acdf607189a41b24f9da874f37714d43318718b2e5291e0fb0651462ffee4c2b11f4f69884f85d222a0d8955158dacad0afb10226c92aa9d9b78b33a7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1904 1908 WerFault.exe eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1904 WerFault.exe
1904 WerFault.exe
1904 WerFault.exe
1904 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1904 WerFault.exe

pid	pid_target	process	target process
1904	1908	WerFault.exe	eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe

description	pid	process
Token: SeDebugPrivilege	1904	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe

description	pid	process	target process
PID 1908 wrote to memory of 1904	1908	eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe	WerFault.exe
PID 1908 wrote to memory of 1904	1908	eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe	WerFault.exe
PID 1908 wrote to memory of 1904	1908	eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe	WerFault.exe
PID 1908 wrote to memory of 1904	1908	eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe
"C:\Users\Admin\AppData\Local\Temp\eec88ca50dfe87580123cd0d582b1196bc974efdbecb256d5e59dc52ca6d48d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

memory/1904-61-0x0000000000000000-mapping.dmp

Download
memory/1904-62-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1908-55-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/1908-57-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1908-58-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/1908-59-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1908-60-0x0000000004C70000-0x0000000004CB4000-memory.dmp

Filesize
272KB

Download