1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc

Analysis

Target

1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe
Size

100KB
MD5

4bcd89160708645b32c5d0a6074c2804
SHA1

d6f00f88d5ea4ffd4731e827bf2203cd22d6ac61
SHA256

1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc
SHA512

bdcf9a767602366c3b9f1cfd01d196c89ccd89eae3bf511ab4844e85dc894f7b5649dc2c3304855490178f9ec7364874bd9c98e420b10e9d20378086649e0668

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

848 1892 WerFault.exe 1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

848 WerFault.exe
848 WerFault.exe
848 WerFault.exe
848 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

848 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 848 WerFault.exe

pid	pid_target	process	target process
848	1892	WerFault.exe	1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe

pid	process
848	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	848	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe

description	pid	process	target process
PID 1892 wrote to memory of 848	1892	1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe	WerFault.exe
PID 1892 wrote to memory of 848	1892	1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe	WerFault.exe
PID 1892 wrote to memory of 848	1892	1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe	WerFault.exe
PID 1892 wrote to memory of 848	1892	1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe
"C:\Users\Admin\AppData\Local\Temp\1375e3516d8202ca292152945dff3b8333e5edd705288c682910fd033a0ceefc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892

memory/848-56-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1892-54-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download