2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5

Analysis

Target

2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe
Size

83KB
MD5

e42ac49a9fc4d0aeb156cdb897f4e6eb
SHA1

ff0bd9bdef2b091f322fa1fbf1f1ed04fe8c9a91
SHA256

2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5
SHA512

6250eec3e7f03a2fbdebf32e730dca0251630248c3f205e82ed8eeb2890aeee1c4269b373e28fb100f35453af0c52803d38934792922c10a156788287dcc0a9e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	612	WerFault.exe	18

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 1684	612	2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe	27
PID 612 wrote to memory of 1684	612	2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe	27
PID 612 wrote to memory of 1684	612	2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe	27
PID 612 wrote to memory of 1684	612	2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe	27

C:\Users\Admin\AppData\Local\Temp\2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe
"C:\Users\Admin\AppData\Local\Temp\2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1684

memory/1684-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1684-55-0x00000000002C0000-0x00000000002D5000-memory.dmp

Filesize
84KB

Download