e334369d4dffb0045792f6a45b6636c014d3e9624f41f1266b415256b17e4099

General

Target
PO#47858574398745.exe
Size 484KB
Sample200624-3886deptjs
SHA256 e334369d4dffb0045792f6a45b6636c014d3e9624f41f1266b415256b17e4099
MD5 46e22ef1d797322eaea358e36ae85c03
SHA1 752c79cab4cac715820535ad8bcc1c31b32f91fd
SHA512 629357b8e1acfc2e77d39c2dfebe9c27ba20f51d6d32a7395c2ef1693b76994391250ee2e3d6f61892d84282debbea9998539a3cf60c1b37cf88d16b66524baa
MD5 SHA1 SHA512

Score

8^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious behavior: EnumeratesProcesses 27 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1688	3920	PO#47858574398745.exe	68
PID 3920 wrote to memory of 1688	3920	PO#47858574398745.exe	68
PID 3920 wrote to memory of 1688	3920	PO#47858574398745.exe	68
PID 3920 wrote to memory of 3492	3920	PO#47858574398745.exe	69
PID 3920 wrote to memory of 3492	3920	PO#47858574398745.exe	69
PID 3920 wrote to memory of 3492	3920	PO#47858574398745.exe	69
PID 3492 wrote to memory of 640	3492	Outlook.exe	74
PID 3492 wrote to memory of 640	3492	Outlook.exe	74
PID 3492 wrote to memory of 640	3492	Outlook.exe	74
PID 3492 wrote to memory of 804	3492	Outlook.exe	75
PID 3492 wrote to memory of 804	3492	Outlook.exe	75
PID 3492 wrote to memory of 804	3492	Outlook.exe	75
PID 3492 wrote to memory of 804	3492	Outlook.exe	75
PID 3492 wrote to memory of 804	3492	Outlook.exe	75

Executes dropped EXE 1 IoCs

pid	Process
3492	Outlook.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3672	1688	WerFault.exe	68
1184	640	WerFault.exe	74

C:\Users\Admin\AppData\Local\Temp\PO#47858574398745.exe
"C:\Users\Admin\AppData\Local\Temp\PO#47858574398745.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 700
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    PID:3672
- C:\ProgramData\Outlook.exe
  "C:\ProgramData\Outlook.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3492
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    PID:640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 704
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious behavior: EnumeratesProcesses
      Program crash
      PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:804

memory/1184-59-0x00000000054A0000-0x00000000054A1000-memory.dmp

Download

memory/1184-52-0x0000000004E70000-0x0000000004E71000-memory.dmp

Download

memory/3492-49-0x0000000002280000-0x00000000023D3000-memory.dmp

Download

memory/3672-12-0x0000000005490000-0x0000000005491000-memory.dmp

Download

memory/3672-5-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download

memory/3920-0-0x0000000000F20000-0x0000000001073000-memory.dmp

Download