2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57

Analysis

Target

2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe
Size

176KB
MD5

d97e7941669a5f68f78603d8b3854762
SHA1

265e7a75838acdf2aeb236aedbd07db2d939bcd6
SHA256

2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57
SHA512

687e7a3cfacda0367e25de4e9b437a71a9c21be79df1b90ecf4aa826ffa1d2339672ddda916826201127efe817e7b0ebefc98c001504c744d3df8c7e8a6fa96c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1456 1612 WerFault.exe 2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1456 WerFault.exe
1456 WerFault.exe
1456 WerFault.exe
1456 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1456 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1456 WerFault.exe

pid	pid_target	process	target process
1456	1612	WerFault.exe	2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe

pid	process
1456	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1456	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe

description	pid	process	target process
PID 1612 wrote to memory of 1456	1612	2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe	WerFault.exe
PID 1612 wrote to memory of 1456	1612	2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe	WerFault.exe
PID 1612 wrote to memory of 1456	1612	2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe	WerFault.exe
PID 1612 wrote to memory of 1456	1612	2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe
"C:\Users\Admin\AppData\Local\Temp\2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

memory/1456-55-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/1456-56-0x00000000004E0000-0x000000000050C000-memory.dmp

Filesize
176KB

Download