800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64

Resubmissions

03-02-2022 13:26

01-02-2022 11:13

01-02-2022 11:12

31-12-2021 08:31

Target

ConsoleApp7.exe
Size

53KB
MD5

b2993b2a7a1edba14742564de7e85cb2
SHA1

cf7f1085978128cc082aec921d34d6d25e4ab19b
SHA256

800b4455105a08833332092017909f9dd47bd4ebfb1cbddbe0b95658d03b8d64
SHA512

a64951f5026a2f3bb01652bae0267b1d4b88b017a64208bb2e556a755a44e86eab0df33d43e759defe4caefc30693099b74fa1ebac90ff323ac2e555f51d892a

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1224 2016 WerFault.exe ConsoleApp7.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1224 WerFault.exe
1224 WerFault.exe
1224 WerFault.exe
1224 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ConsoleApp7.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 2016 ConsoleApp7.exe
Token: SeDebugPrivilege 1224 WerFault.exe

pid	pid_target	process	target process
1224	2016	WerFault.exe	ConsoleApp7.exe

description	pid	process
Token: SeDebugPrivilege	2016	ConsoleApp7.exe
Token: SeDebugPrivilege	1224	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ConsoleApp7.exe

description	pid	process	target process
PID 2016 wrote to memory of 1224	2016	ConsoleApp7.exe	WerFault.exe
PID 2016 wrote to memory of 1224	2016	ConsoleApp7.exe	WerFault.exe
PID 2016 wrote to memory of 1224	2016	ConsoleApp7.exe	WerFault.exe
PID 2016 wrote to memory of 1224	2016	ConsoleApp7.exe	WerFault.exe

memory/1224-58-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2016-54-0x0000000000300000-0x0000000000312000-memory.dmp

Filesize
72KB

Download
memory/2016-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download