e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b

Analysis

Target

e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe
Size

157KB
MD5

b537e5c602462765015642941cf262ec
SHA1

b07004ddfb0e4ed21c938a2be1cef782246425e3
SHA256

e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b
SHA512

3c7ed26cc2978c2fc36e11feb3fb23699202a4b7899e7edbf0b6858e103c19ab7a78796aaf500388615f711362638019fc7fc6cfcf986ef960a8837eb12e5fda

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 1788 WerFault.exe e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1916 WerFault.exe
1916 WerFault.exe
1916 WerFault.exe
1916 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1916 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1916 WerFault.exe

pid	pid_target	process	target process
1916	1788	WerFault.exe	e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe

pid	process
1916	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1916	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe

description	pid	process	target process
PID 1788 wrote to memory of 1916	1788	e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe	WerFault.exe
PID 1788 wrote to memory of 1916	1788	e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe	WerFault.exe
PID 1788 wrote to memory of 1916	1788	e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe	WerFault.exe
PID 1788 wrote to memory of 1916	1788	e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe
"C:\Users\Admin\AppData\Local\Temp\e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788

memory/1916-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1916-55-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download