b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3

Analysis

Target

b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe
Size

151KB
MD5

6283ab9805e50e9ea3a9a578ec514b6f
SHA1

7cd90278ae5a7de520e52049ad82edbc16b474fc
SHA256

b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3
SHA512

fe3e507dec4501997898daf06b5752cdb1630a1c310df050220a44dde8012c3b7f66a5de76d0dbe4503b05f4b71aae9d171eb2a32419851fc84300e7019f757d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1976 884 WerFault.exe b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

description pid process

Token: SeDebugPrivilege 884 b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

pid	pid_target	process	target process
1976	884	WerFault.exe	b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

description	pid	process
Token: SeDebugPrivilege	884	b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

description	pid	process	target process
PID 884 wrote to memory of 1976	884	b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe	WerFault.exe
PID 884 wrote to memory of 1976	884	b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe	WerFault.exe
PID 884 wrote to memory of 1976	884	b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe	WerFault.exe
PID 884 wrote to memory of 1976	884	b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 1028
2⤵
- Program crash
PID:1976

memory/884-54-0x0000000000D10000-0x0000000000D3E000-memory.dmp

Filesize
184KB

Download
memory/884-55-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/884-56-0x0000000000530000-0x0000000000548000-memory.dmp

Filesize
96KB

Download
memory/884-57-0x0000000000540000-0x0000000000546000-memory.dmp

Filesize
24KB

Download
memory/884-58-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1976-59-0x0000000000000000-mapping.dmp

Download