489e4ff4fe5b8ab211bb956c6518accebaf82dfcaa9db07d8e865c894a2ee446

Analysis

Target
Names on property deed.exe
Size 5.2MB
Sample200717-4m223azfv2
SHA256 489e4ff4fe5b8ab211bb956c6518accebaf82dfcaa9db07d8e865c894a2ee446
MD5 6299191fbb293b68a4a188209143f2cd
SHA1 e3df021a28f2e3661e911af69a31fc390477b13a
SHA512 e6a1a55fa72aea4538a8fe71f221bdb58236592cd878740a7141291e5e500db181fdb0cd9a98973d4864b62e8c18011b31b0cee6ed11153b5dbe02230a1b93aa
MD5 SHA1 SHA512

Score

7^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	788	WerFault.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1016	1496	Names on property deed.exe	24
PID 1496 wrote to memory of 1016	1496	Names on property deed.exe	24
PID 1496 wrote to memory of 1016	1496	Names on property deed.exe	24
PID 1496 wrote to memory of 1016	1496	Names on property deed.exe	24
PID 1496 wrote to memory of 1016	1496	Names on property deed.exe	24
PID 1496 wrote to memory of 1016	1496	Names on property deed.exe	24
PID 1496 wrote to memory of 1016	1496	Names on property deed.exe	24
PID 1016 wrote to memory of 788	1016	rundll32.exe	25
PID 1016 wrote to memory of 788	1016	rundll32.exe	25
PID 1016 wrote to memory of 788	1016	rundll32.exe	25
PID 1016 wrote to memory of 788	1016	rundll32.exe	25

Loads dropped DLL 1 IoCs

pid	Process
1016	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
788	1016	WerFault.exe	24

C:\Users\Admin\AppData\Local\Temp\Names on property deed.exe
"C:\Users\Admin\AppData\Local\Temp\Names on property deed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe Spermatocyte,Michelle
  2⤵
  - Suspicious use of WriteProcessMemory
  - Loads dropped DLL
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 236
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Program crash
    PID:788

memory/788-5-0x00000000020F0000-0x0000000002101000-memory.dmp

Download

memory/788-7-0x0000000002500000-0x0000000002511000-memory.dmp

Download