0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d

Analysis

Target

0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe
Size

1.7MB
MD5

4740d75e1acce41b474cd2cb104690cd
SHA1

dddcd28617e72d7500694caeaecc7386a1db97e0
SHA256

0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d
SHA512

83d66ef41befb02c2d7bfd5755271296790039258205988d293a2162b34dc766264d807a86ba665c43dec25542e380c168a09af21dd161325ff711fceb2aa217

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1168 2008 WerFault.exe 0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe

description pid process

Token: SeDebugPrivilege 2008 0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe

pid	pid_target	process	target process
1168	2008	WerFault.exe	0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe

description	pid	process
Token: SeDebugPrivilege	2008	0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe

description	pid	process	target process
PID 2008 wrote to memory of 1168	2008	0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe	WerFault.exe
PID 2008 wrote to memory of 1168	2008	0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe	WerFault.exe
PID 2008 wrote to memory of 1168	2008	0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe	WerFault.exe
PID 2008 wrote to memory of 1168	2008	0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1276
2⤵
- Program crash
PID:1168

memory/1168-65-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x0000000000BB0000-0x0000000000D66000-memory.dmp

Filesize
1.7MB

Download
memory/2008-55-0x0000000072080000-0x000000007340F000-memory.dmp

Filesize
19.6MB

Download
memory/2008-56-0x0000000070E90000-0x0000000071670000-memory.dmp

Filesize
7.9MB

Download
memory/2008-57-0x0000000073CA0000-0x0000000073DC3000-memory.dmp

Filesize
1.1MB

Download
memory/2008-58-0x0000000071670000-0x0000000072080000-memory.dmp

Filesize
10.1MB

Download
memory/2008-59-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/2008-60-0x0000000073A00000-0x0000000073AFC000-memory.dmp

Filesize
1008KB

Download
memory/2008-61-0x0000000070750000-0x0000000070E8E000-memory.dmp

Filesize
7.2MB

Download
memory/2008-62-0x0000000072080000-0x000000007340F000-memory.dmp

Filesize
19.6MB

Download
memory/2008-63-0x0000000073CA0000-0x0000000073DC3000-memory.dmp

Filesize
1.1MB

Download
memory/2008-64-0x0000000071670000-0x0000000072080000-memory.dmp

Filesize
10.1MB

Download