82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7

Analysis

Target

82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7.exe
Size

53KB
MD5

da95ea96dc4029e73b292b91e493e9d7
SHA1

11bf7fb66852f2cd4555b0a4b30b42fe7f0c25d9
SHA256

82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7
SHA512

3b3c1b0a9d9d13a439af5946ef1ff5014e1217e7efda9815355103d5bcae3dfc4b2218e7f658355e74c3dc0ecd689fcdb9f730d5d2c6f4b00384e16b662932dd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	1616	WerFault.exe	14

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
812	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 812	1616	82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7.exe	27
PID 1616 wrote to memory of 812	1616	82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7.exe	27
PID 1616 wrote to memory of 812	1616	82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7.exe	27
PID 1616 wrote to memory of 812	1616	82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7.exe	27

C:\Users\Admin\AppData\Local\Temp\82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7.exe
"C:\Users\Admin\AppData\Local\Temp\82b427884a39fd1b2476603efbf8df2f2d8c5d24b4335b9824779b84ddc95ce7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 160
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:812

memory/812-57-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/1616-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download