bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079

Analysis

Target

bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe
Size

165KB
MD5

40c06ece16e5aded556808835ea1d6a9
SHA1

56e7d4848a76d4ce4563ceaae700ba517ef3e2b0
SHA256

bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079
SHA512

07f88237c328099bb27ff450924efe1bbff2fdf194b0e1dd85eb3961835e22205a37d6ce878f767d32841ccc0fa3ef1348e14e759cacbd973d1fc5b30720847b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1648 804 WerFault.exe bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1648 WerFault.exe
1648 WerFault.exe
1648 WerFault.exe
1648 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1648 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1648 WerFault.exe

pid	pid_target	process	target process
1648	804	WerFault.exe	bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe

pid	process
1648	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1648	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe

description	pid	process	target process
PID 804 wrote to memory of 1648	804	bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe	WerFault.exe
PID 804 wrote to memory of 1648	804	bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe	WerFault.exe
PID 804 wrote to memory of 1648	804	bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe	WerFault.exe
PID 804 wrote to memory of 1648	804	bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe
"C:\Users\Admin\AppData\Local\Temp\bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:804

memory/1648-54-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download
memory/1648-55-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download