c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346

Analysis

Target

c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe
Size

180KB
MD5

c2897e8383438ebe3951b32756376c8d
SHA1

a4bf93a363f0cb5daada1616f529382097e03219
SHA256

c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346
SHA512

61ab05ca1ea4a67d202dbaf56b2fcdf01348b0e5979be3a5ef971fb4d975bc8b2bf63e60c50913f39e449676b6ffc573ee1f4bfc1d66de1668ba1a9a78caa51c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

524 1668 WerFault.exe c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

524 WerFault.exe
524 WerFault.exe
524 WerFault.exe
524 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

524 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 524 WerFault.exe

pid	pid_target	process	target process
524	1668	WerFault.exe	c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe

pid	process
524	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	524	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe

description	pid	process	target process
PID 1668 wrote to memory of 524	1668	c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe	WerFault.exe
PID 1668 wrote to memory of 524	1668	c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe	WerFault.exe
PID 1668 wrote to memory of 524	1668	c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe	WerFault.exe
PID 1668 wrote to memory of 524	1668	c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe
"C:\Users\Admin\AppData\Local\Temp\c68f3dc3978815a80ed2ed0e74b75b0730d6bf552b56191ef21071ea9ef93346.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668

memory/524-55-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/524-56-0x0000000000450000-0x000000000047C000-memory.dmp

Filesize
176KB

Download