c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46

Analysis

Target

c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe
Size

115KB
MD5

93f39b95d6a7e7018e0c29e3eeed70f5
SHA1

f8ffd584a5d0e358243fe175643eae2ce70d685c
SHA256

c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46
SHA512

5bf250691b43d9974cfacc6beca8a390d8a4c3bf350369af5b41464b0d973b5b167735924797e8a43a310b4b5e5fe5a4bc4deb630b4d7157a8fcf97d00167a3d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1784 1556 WerFault.exe c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1784 WerFault.exe
1784 WerFault.exe
1784 WerFault.exe
1784 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1784 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1784 WerFault.exe

pid	pid_target	process	target process
1784	1556	WerFault.exe	c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe

pid	process
1784	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1784	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe

description	pid	process	target process
PID 1556 wrote to memory of 1784	1556	c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe	WerFault.exe
PID 1556 wrote to memory of 1784	1556	c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe	WerFault.exe
PID 1556 wrote to memory of 1784	1556	c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe	WerFault.exe
PID 1556 wrote to memory of 1784	1556	c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe
"C:\Users\Admin\AppData\Local\Temp\c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

memory/1784-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/1784-56-0x0000000000240000-0x0000000000440000-memory.dmp

Filesize
2.0MB

Download