d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482

Analysis

Target

d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe
Size

357KB
MD5

112e09468511348fc4eb4b6c57d154a8
SHA1

7f0e0dffba710f6066b6cfdd8bfcff1b40129c41
SHA256

d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482
SHA512

4860bf55a910228131a138e5358a6c68f22306acd3703e177c9dc49cd3b1e55bc49380891db5083af82488d57e0e01c374a1631385624770dde8c3c8ebdff516

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1772 1536 WerFault.exe d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1772 WerFault.exe
1772 WerFault.exe
1772 WerFault.exe
1772 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1772 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1772 WerFault.exe

pid	pid_target	process	target process
1772	1536	WerFault.exe	d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe

pid	process
1772	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1772	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe

description	pid	process	target process
PID 1536 wrote to memory of 1772	1536	d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe	WerFault.exe
PID 1536 wrote to memory of 1772	1536	d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe	WerFault.exe
PID 1536 wrote to memory of 1772	1536	d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe	WerFault.exe
PID 1536 wrote to memory of 1772	1536	d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe
"C:\Users\Admin\AppData\Local\Temp\d5d6975b713047fc1050762b4f4d8d8225647c147ccd2d51bfc1704f68c3d482.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536

memory/1772-55-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x0000000000560000-0x000000000058C000-memory.dmp

Filesize
176KB

Download