592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd

Analysis

Target

tmp/592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe
Size

235KB
MD5

d0b0c9cae5e6be5d5b09cad366c57c49
SHA1

42e18682d6b37d50a3c763846c14ea4a5bc38d40
SHA256

592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd
SHA512

c3704c6e2267a933e291b8c2e57c7934f34e10c8befd76ec1d5d93101b0bb1e63a4d2b681256b929d1f3326ec6951c353d0a9705d61a2bb94ec9723069d5fbe9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1632 1436 WerFault.exe 592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1632 WerFault.exe
1632 WerFault.exe
1632 WerFault.exe
1632 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1632 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1632 WerFault.exe

pid	pid_target	process	target process
1632	1436	WerFault.exe	592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe

pid	process
1632	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1632	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe

description	pid	process	target process
PID 1436 wrote to memory of 1632	1436	592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe	WerFault.exe
PID 1436 wrote to memory of 1632	1436	592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe	WerFault.exe
PID 1436 wrote to memory of 1632	1436	592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe	WerFault.exe
PID 1436 wrote to memory of 1632	1436	592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp\592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1632-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1632-56-0x0000000001E40000-0x0000000001E7D000-memory.dmp

Filesize
244KB

Download