fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b

Analysis

Target

fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe
Size

139KB
MD5

e593252c2de2d17c81a4b4e8b870dbc4
SHA1

8d9ce65aa7fd29e2fb10ac74a80ec8c39e645e29
SHA256

fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b
SHA512

983f09fa24a802ea60003472b6038ce85c8bf0085880a14a08ad0f7388a052eef5a9c7ee42e5ed7819af191e03b69944071142b8e0087404765c5f6d51351a2f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 1568 WerFault.exe fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1924 WerFault.exe
1924 WerFault.exe
1924 WerFault.exe
1924 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1924 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1924 WerFault.exe

pid	pid_target	process	target process
1924	1568	WerFault.exe	fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe

pid	process
1924	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1924	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe

description	pid	process	target process
PID 1568 wrote to memory of 1924	1568	fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe	WerFault.exe
PID 1568 wrote to memory of 1924	1568	fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe	WerFault.exe
PID 1568 wrote to memory of 1924	1568	fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe	WerFault.exe
PID 1568 wrote to memory of 1924	1568	fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe
"C:\Users\Admin\AppData\Local\Temp\fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

memory/1568-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmp

Filesize
8KB

Download
memory/1924-56-0x00000000005F0000-0x000000000061D000-memory.dmp

Filesize
180KB

Download