b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92

Analysis

Target

tmp/b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe
Size

235KB
MD5

44dbd40c248e103e86aeff57f2cb5579
SHA1

130124ad1fc46047d76165ee00a96842c97fbba0
SHA256

b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92
SHA512

100bcff283a831f440d76593e7582d77e44f313b683738f9b0103bea54675292dbaee9849e363bd90dc12f52919f7b38d009e021de8698cbd7569cc6db8d865f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1212 1536 WerFault.exe b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1212 WerFault.exe
1212 WerFault.exe
1212 WerFault.exe
1212 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1212 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1212 WerFault.exe

pid	pid_target	process	target process
1212	1536	WerFault.exe	b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe

pid	process
1212	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1212	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe

description	pid	process	target process
PID 1536 wrote to memory of 1212	1536	b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe	WerFault.exe
PID 1536 wrote to memory of 1212	1536	b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe	WerFault.exe
PID 1536 wrote to memory of 1212	1536	b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe	WerFault.exe
PID 1536 wrote to memory of 1212	1536	b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp\b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

memory/1212-55-0x0000000000000000-mapping.dmp

Download
memory/1212-56-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download
memory/1212-57-0x0000000000850000-0x000000000088D000-memory.dmp

Filesize
244KB

Download