6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39

General

Target

6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
Size

169KB
MD5

d3c8ecf591381b31d3aa796471b5b0f1
SHA1

efb8b908c614ef0dc791e53ad579485bc6f5e33b
SHA256

6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39
SHA512

a49d1bef7ae6e40809efe3055a78ef5d2b8c8ecbafc4499c834c80c4ad7cd1aa839e9a0914902e86b1307324b4b3d8c5f097a741ec598f1a8dd333276d54748a

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

Processes:

6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

description	pid	process	target process
PID 2656 set thread context of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1528 2188 WerFault.exe 6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

description pid process

Token: SeDebugPrivilege 2656 6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

pid	pid_target	process	target process
1528	2188	WerFault.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

description	pid	process
Token: SeDebugPrivilege	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

description	pid	process	target process
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
PID 2656 wrote to memory of 2188	2656	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe	6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe

C:\Users\Admin\AppData\Local\Temp\6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
C:\Users\Admin\AppData\Local\Temp\6bb3c42d9ed6d25bd82fa8568cee962b6e10edddc38bc5273e97e5128872ae39.exe
2⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 92
3⤵
- Program crash
PID:1528

memory/2656-118-0x0000000000CC0000-0x0000000000CF2000-memory.dmp

Filesize
200KB

Download
memory/2656-119-0x0000000005790000-0x000000000582C000-memory.dmp

Filesize
624KB

Download