51636185f050c3bd7831ae68d4ebe8c46192cd64112a0762cd8ea92cc4d35894

Analysis

Target
92e6d1acf256d3f269493a7737073277.exe
Size 3.3MB
Sample220206-thx6vsbecl
SHA256 51636185f050c3bd7831ae68d4ebe8c46192cd64112a0762cd8ea92cc4d35894
MD5 92e6d1acf256d3f269493a7737073277
SHA1 05c58732ca084aedc71dc39e9d3cb3cb45c1172c
SHA512 3738a684ee2f22d64ac0d3e2ac0115b53f0548a4c4202701ff045405d6e4c873602a3c34bc45d7bb33b721c98bf3bf5f81ed5f7eb6c35dbc215ccf0e0cf87fff
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	956	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1784	956	92e6d1acf256d3f269493a7737073277.exe	27
PID 956 wrote to memory of 1784	956	92e6d1acf256d3f269493a7737073277.exe	27
PID 956 wrote to memory of 1784	956	92e6d1acf256d3f269493a7737073277.exe	27
PID 956 wrote to memory of 1784	956	92e6d1acf256d3f269493a7737073277.exe	27

C:\Users\Admin\AppData\Local\Temp\92e6d1acf256d3f269493a7737073277.exe
"C:\Users\Admin\AppData\Local\Temp\92e6d1acf256d3f269493a7737073277.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 120
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1784

memory/1784-55-0x0000000076511000-0x0000000076513000-memory.dmp

Download

memory/1784-56-0x0000000000280000-0x0000000000281000-memory.dmp

Download