a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb

Analysis

Target

a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe
Size

96KB
MD5

d7f93757123c79564b540e59ed188974
SHA1

723e3879bae0772badef7b058db64dc947a5d8ba
SHA256

a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb
SHA512

13ca67a8ba4286cc00d8e57deadf39b0de49f8829f28ac13893eb094664c94586d5772da675d016f4d6041927163433b58a93c97babc9ddb5e44b8dbf735db8f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	1504	WerFault.exe	10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1608	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1608	1504	a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe	27
PID 1504 wrote to memory of 1608	1504	a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe	27
PID 1504 wrote to memory of 1608	1504	a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe	27
PID 1504 wrote to memory of 1608	1504	a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe	27

C:\Users\Admin\AppData\Local\Temp\a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe
"C:\Users\Admin\AppData\Local\Temp\a6903580ab0f4f6e41778b8d20c663b56436ae1dda08a241f3ac22ad329870fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1608

memory/1608-54-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download
memory/1608-55-0x0000000000380000-0x0000000000398000-memory.dmp

Filesize
96KB

Download