3412f3e08654eceebff6c557eb9f0e82ab9e7b4cf5b0a3b9f2c7fefa5d07fe75

Analysis

Target

INVtransfercopyreceipt07072020.exe
Size

346KB
MD5

7e5783717dd46ed1a4cb15fb803fa44a
SHA1

3845da005de6a12f9058fc717a7e9cfe78f06372
SHA256

3412f3e08654eceebff6c557eb9f0e82ab9e7b4cf5b0a3b9f2c7fefa5d07fe75
SHA512

1d02fc33a067531a532a329e96f1675afa6396375fa44e890e7443e1c56bf5fe53465f0579d585d55c325ddb89535682a690fb12442e574c6ee63a820e1d8d59

Score

7^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1772 WerFault.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1772 WerFault.exe
1772 WerFault.exe
1772 WerFault.exe
1772 WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1772	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

INVtransfercopyreceipt07072020.exerundll32.exe

description	pid	process	target process
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	rundll32.exe
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	rundll32.exe
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	rundll32.exe
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	rundll32.exe
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	rundll32.exe
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	rundll32.exe
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	rundll32.exe
PID 1784 wrote to memory of 1772	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 1772	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 1772	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 1772	1784	rundll32.exe	WerFault.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1784 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1772 1784 WerFault.exe rundll32.exe

pid	process
1784	rundll32.exe

pid	pid_target	process	target process
1772	1784	WerFault.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\INVtransfercopyreceipt07072020.exe
"C:\Users\Admin\AppData\Local\Temp\INVtransfercopyreceipt07072020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\Archery

Download Submit
C:\Users\Admin\AppData\Local\Temp\Subclimax.DLL

Download Submit
\Users\Admin\AppData\Local\Temp\Subclimax.dll

Download Submit
memory/1772-4-0x0000000000000000-mapping.dmp

Download
memory/1772-5-0x00000000022C0000-0x00000000022D1000-memory.dmp

Filesize
68KB

Download
memory/1772-7-0x00000000027B0000-0x00000000027C1000-memory.dmp

Filesize
68KB

Download
memory/1784-0-0x0000000000000000-mapping.dmp

Download
memory/1784-6-0x0000000000000000-mapping.dmp

Download