080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30

Analysis

Target

080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe
Size

100KB
MD5

e8bad289600fb12db5297b877069d4aa
SHA1

30bdb4c6dabc46e8d0db4315041018169f95f828
SHA256

080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30
SHA512

4c8e3f298f13b5770cd195520e9fc76f89254a4f15404d9152dc655c8323ef018bc2cf4df15d7c5cf4487716c365fb2071eedcc236911e578672bd411f9047d6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1288 1468 WerFault.exe 080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1288 WerFault.exe
1288 WerFault.exe
1288 WerFault.exe
1288 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1288 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1288 WerFault.exe

pid	pid_target	process	target process
1288	1468	WerFault.exe	080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe

pid	process
1288	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1288	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe

description	pid	process	target process
PID 1468 wrote to memory of 1288	1468	080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe	WerFault.exe
PID 1468 wrote to memory of 1288	1468	080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe	WerFault.exe
PID 1468 wrote to memory of 1288	1468	080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe	WerFault.exe
PID 1468 wrote to memory of 1288	1468	080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe
"C:\Users\Admin\AppData\Local\Temp\080b8c9c11489dd603b1e8d009f921c20c5aef622ca05b05b0af41b694551a30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

memory/1288-56-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1468-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download