ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67

Analysis

Target

ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67.exe
Size

49KB
MD5

30e91446a5174e869559307991a483d7
SHA1

e1a8b3423eb5b8d35e563d69cfd9d8543de2618d
SHA256

ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67
SHA512

af8258238d602697a8ae0c7e965a90f1ac7d0ed2fae24bc7874e82fba55b075854d9ab38a07139e48ae30ab9ebd6c7e86e73b3aa76742c5324d240b0f02e4ce6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	1700	WerFault.exe	15

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1388	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1388	1700	ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67.exe	27
PID 1700 wrote to memory of 1388	1700	ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67.exe	27
PID 1700 wrote to memory of 1388	1700	ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67.exe	27
PID 1700 wrote to memory of 1388	1700	ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67.exe	27

C:\Users\Admin\AppData\Local\Temp\ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67.exe
"C:\Users\Admin\AppData\Local\Temp\ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 36
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1388

memory/1388-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x0000000000910000-0x0000000000921000-memory.dmp

Filesize
68KB

Download