752c933394c080ea667a1d098c603a7216c16cdfb2bae516d78a0aeb14543248

General

Target

payment _doc.exe
Size

884KB
MD5

d65c9fe128d2294055cc9b3238e67c07
SHA1

1495109fc0760f4becd195b790206a0fc00b89ce
SHA256

ad03ca16b05c593894d3cf90ea6ebe56f3ce6dc94dc0675234f357893f3aadfa
SHA512

60b9fb9c9d159dac7d9a486ebf7dba7387ac45ab184857a0721d59e2a78dc4a4e074b80126d912d4a00351345f564e283ef2bf7630c437147d398a52b4f9fb21

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

payment _doc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

payment _doc.exe

description pid process

Token: SeDebugPrivilege 1676 payment _doc.exe

description	pid	process
Token: SeDebugPrivilege	1676	payment _doc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

payment _doc.exe

description	pid	process	target process
PID 1676 wrote to memory of 800	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 800	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 800	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 800	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1092	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1092	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1092	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1092	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1200	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1200	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1200	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1200	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1096	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1096	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1096	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 1096	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 432	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 432	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 432	1676	payment _doc.exe	payment _doc.exe
PID 1676 wrote to memory of 432	1676	payment _doc.exe	payment _doc.exe

C:\Users\Admin\AppData\Local\Temp\payment _doc.exe
"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"
2⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\payment _doc.exe
"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"
2⤵
PID:1092

C:\Users\Admin\AppData\Local\Temp\payment _doc.exe
"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"
2⤵
PID:1200

C:\Users\Admin\AppData\Local\Temp\payment _doc.exe
"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"
2⤵
PID:1096

C:\Users\Admin\AppData\Local\Temp\payment _doc.exe
"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"
2⤵
PID:432

memory/1676-2-0x00000000741A0000-0x000000007488E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-3-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1676-5-0x0000000000810000-0x0000000000833000-memory.dmp

Filesize
140KB

Download
memory/1676-6-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1676-7-0x0000000005110000-0x0000000005171000-memory.dmp

Filesize
388KB

Download