3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81

Analysis

Target

3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe
Size

176KB
MD5

60658a91c768190fe0d2af85e01b65a1
SHA1

c910ac4e5fc7ec19da61b2ca5e2ac9ae245769b0
SHA256

3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81
SHA512

53582b4a439650b30a264c8a6928b725ad2a91701dd33140f9a88a8e757cfe94830209db55ec8baff6231a28cf778edf8ad51e5617ce0d19b4dcfcdff3257fda

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

808 1564 WerFault.exe 3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

808 WerFault.exe
808 WerFault.exe
808 WerFault.exe
808 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

808 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 808 WerFault.exe

pid	pid_target	process	target process
808	1564	WerFault.exe	3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe

pid	process
808	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	808	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe

description	pid	process	target process
PID 1564 wrote to memory of 808	1564	3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe	WerFault.exe
PID 1564 wrote to memory of 808	1564	3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe	WerFault.exe
PID 1564 wrote to memory of 808	1564	3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe	WerFault.exe
PID 1564 wrote to memory of 808	1564	3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe
"C:\Users\Admin\AppData\Local\Temp\3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564

memory/808-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/808-55-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download