938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c

Analysis

Target

938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe
Size

160KB
MD5

48213007810cd3dea37b94c06e80059d
SHA1

58abd2f6abe56634204a30f94ddc3c90c8abf686
SHA256

938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c
SHA512

7dddc9c3d5f2a334a1b3c72044290e807b7f25f60ef18447888630491e866c4c3502c4df48bc028b2a59dd613686e20ceac500923625a5032a21bb4ee93d0023

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1592 812 WerFault.exe 938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1592 WerFault.exe
1592 WerFault.exe
1592 WerFault.exe
1592 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1592 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1592 WerFault.exe

pid	pid_target	process	target process
1592	812	WerFault.exe	938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe

pid	process
1592	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1592	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe

description	pid	process	target process
PID 812 wrote to memory of 1592	812	938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe	WerFault.exe
PID 812 wrote to memory of 1592	812	938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe	WerFault.exe
PID 812 wrote to memory of 1592	812	938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe	WerFault.exe
PID 812 wrote to memory of 1592	812	938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe
"C:\Users\Admin\AppData\Local\Temp\938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812

memory/1592-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download
memory/1592-55-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download