dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68

Analysis

Target

dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
Size

141KB
MD5

c6f49e8eec2e156e5e36eb7b27ec7929
SHA1

5685728581547dc774396165431a66de3d2526f7
SHA256

dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68
SHA512

a01d6f38a485ec890834b164447fd97485adc3883cb9979dbd4cb7e97e213e2a39f82d7e851de4c5bbce42ab09ae161fd2ec2f53ce1ffc14102e33f5744f5bcd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

524 1912 WerFault.exe dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

524 WerFault.exe
524 WerFault.exe
524 WerFault.exe
524 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

524 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 524 WerFault.exe

pid	pid_target	process	target process
524	1912	WerFault.exe	dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe

pid	process
524	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	524	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe

description	pid	process	target process
PID 1912 wrote to memory of 524	1912	dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe	WerFault.exe
PID 1912 wrote to memory of 524	1912	dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe	WerFault.exe
PID 1912 wrote to memory of 524	1912	dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe	WerFault.exe
PID 1912 wrote to memory of 524	1912	dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
"C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 100
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:524

memory/524-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/524-55-0x0000000000280000-0x00000000002E0000-memory.dmp

Filesize
384KB

Download