a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba

Analysis

Target

a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba.exe
Size

43KB
MD5

4901423fddb54a564f9ee0a243c91674
SHA1

5c4e62ffaf841fb25c4a936144b58cc6cfbadaba
SHA256

a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba
SHA512

f6f72ea7fa06c3c7fb5b4cfbf2754381138a43b07b186252ac8edb2d5a3ccc3c04a8a3d002d727cd8893767bf2e15c6ca03bbcbe1c8fab3183897a4dc3ff555e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1380	1668	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1380	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1380	1668	a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba.exe	27
PID 1668 wrote to memory of 1380	1668	a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba.exe	27
PID 1668 wrote to memory of 1380	1668	a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba.exe	27
PID 1668 wrote to memory of 1380	1668	a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba.exe	27

C:\Users\Admin\AppData\Local\Temp\a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba.exe
"C:\Users\Admin\AppData\Local\Temp\a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 36
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1380

memory/1380-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1380-56-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download