3412f3e08654eceebff6c557eb9f0e82ab9e7b4cf5b0a3b9f2c7fefa5d07fe75

Analysis

Target

INVtransfercopyreceipt07072020.exe
Size

346KB
MD5

7e5783717dd46ed1a4cb15fb803fa44a
SHA1

3845da005de6a12f9058fc717a7e9cfe78f06372
SHA256

3412f3e08654eceebff6c557eb9f0e82ab9e7b4cf5b0a3b9f2c7fefa5d07fe75
SHA512

1d02fc33a067531a532a329e96f1675afa6396375fa44e890e7443e1c56bf5fe53465f0579d585d55c325ddb89535682a690fb12442e574c6ee63a820e1d8d59

Score

7^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	24
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	24
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	24
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	24
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	24
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	24
PID 1688 wrote to memory of 1784	1688	INVtransfercopyreceipt07072020.exe	24
PID 1784 wrote to memory of 1772	1784	rundll32.exe	25
PID 1784 wrote to memory of 1772	1784	rundll32.exe	25
PID 1784 wrote to memory of 1772	1784	rundll32.exe	25
PID 1784 wrote to memory of 1772	1784	rundll32.exe	25

Loads dropped DLL 1 IoCs

pid	Process
1784	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1784	WerFault.exe	24

C:\Users\Admin\AppData\Local\Temp\INVtransfercopyreceipt07072020.exe
"C:\Users\Admin\AppData\Local\Temp\INVtransfercopyreceipt07072020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe Subclimax,Epimers
  2⤵
  - Suspicious use of WriteProcessMemory
  - Loads dropped DLL
  PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 228
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    PID:1772

memory/1772-5-0x00000000022C0000-0x00000000022D1000-memory.dmp

Filesize
68KB

Download
memory/1772-7-0x00000000027B0000-0x00000000027C1000-memory.dmp

Filesize
68KB

Download