d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48

Analysis

Target

d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe
Size

161KB
MD5

1c6e9d940963410d1ed4ddecafd49f8f
SHA1

5e5d7c7595c60a03858b2285b06ba26e963b9525
SHA256

d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48
SHA512

bbaa603c843c17fabccc987c4aada4e84e0f55680863b20b18565c2dbc81ad59acda359903e8b62408331a4bea55252aacb239699f168079cd356a8b328e7ad3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1100 1848 WerFault.exe d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1100 WerFault.exe
1100 WerFault.exe
1100 WerFault.exe
1100 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1100 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1100 WerFault.exe

pid	pid_target	process	target process
1100	1848	WerFault.exe	d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe

pid	process
1100	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1100	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe

description	pid	process	target process
PID 1848 wrote to memory of 1100	1848	d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe	WerFault.exe
PID 1848 wrote to memory of 1100	1848	d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe	WerFault.exe
PID 1848 wrote to memory of 1100	1848	d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe	WerFault.exe
PID 1848 wrote to memory of 1100	1848	d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe
"C:\Users\Admin\AppData\Local\Temp\d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848

memory/1100-55-0x0000000075421000-0x0000000075423000-memory.dmp

Filesize
8KB

Download
memory/1100-56-0x0000000000A80000-0x0000000000AAC000-memory.dmp

Filesize
176KB

Download