00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271

Resubmissions

22-09-2022 16:59

20-09-2022 10:36

Target

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Size

39KB
MD5

ec263f6b3a0ec7ede4960a2db469fb4e
SHA1

6684ec275e168f999d27f8a2b1f83dcc0ac1ff8f
SHA256

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271
SHA512

51391cc61514cf68b7789c8646315fba04f66c821b0f9dc4bd8d684ea377069f596ff3dfe999e342e580d7139d4967bfe47e1d11ec5b5490173f104938546178
SSDEEP

768:eNkXrdzjDUp3vyE0WFBDiBZn/EvuuXY02pw0MU:eeXxzHUp3vyE0WFBeH/EvuI1I

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2032 932 WerFault.exe 00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description pid process

Token: SeDebugPrivilege 932 00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

pid	pid_target	process	target process
2032	932	WerFault.exe	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description	pid	process
Token: SeDebugPrivilege	932	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe

description	pid	process	target process
PID 932 wrote to memory of 2032	932	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe	WerFault.exe
PID 932 wrote to memory of 2032	932	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe	WerFault.exe
PID 932 wrote to memory of 2032	932	00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe
"C:\Users\Admin\AppData\Local\Temp\00d9a886ffe7c3dda47dd46344b13607546945adc0f38bd4c20952b5a680b271.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 932 -s 176
  2⤵
  - Program crash
  PID:2032