e81d917830f3fabca0557b899267ebe84ecc6fcbb5e1cd649284d1370d8a8876

Analysis

Target
payment details.exe
Size 712KB
Sample210408-12ezy36t82
SHA256 e81d917830f3fabca0557b899267ebe84ecc6fcbb5e1cd649284d1370d8a8876
MD5 55191839573ac8fd25655b3561286bc1
SHA1 b9e85e2ab05e4b027a3f522fd690b097aa4a4aad
SHA512 3488ab665aedfec80b744e403c8a0772097608c679e62b4cce77103b2b3efdad262e41cda0f579533c4d8c061aacf9963a61ab90053fbdf58f70f67685a69c84
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	payment details.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1516	1812	payment details.exe	29
PID 1812 wrote to memory of 1516	1812	payment details.exe	29
PID 1812 wrote to memory of 1516	1812	payment details.exe	29
PID 1812 wrote to memory of 1516	1812	payment details.exe	29
PID 1812 wrote to memory of 1500	1812	payment details.exe	30
PID 1812 wrote to memory of 1500	1812	payment details.exe	30
PID 1812 wrote to memory of 1500	1812	payment details.exe	30
PID 1812 wrote to memory of 1500	1812	payment details.exe	30
PID 1812 wrote to memory of 1468	1812	payment details.exe	31
PID 1812 wrote to memory of 1468	1812	payment details.exe	31
PID 1812 wrote to memory of 1468	1812	payment details.exe	31
PID 1812 wrote to memory of 1468	1812	payment details.exe	31
PID 1812 wrote to memory of 1224	1812	payment details.exe	32
PID 1812 wrote to memory of 1224	1812	payment details.exe	32
PID 1812 wrote to memory of 1224	1812	payment details.exe	32
PID 1812 wrote to memory of 1224	1812	payment details.exe	32
PID 1812 wrote to memory of 1460	1812	payment details.exe	33
PID 1812 wrote to memory of 1460	1812	payment details.exe	33
PID 1812 wrote to memory of 1460	1812	payment details.exe	33
PID 1812 wrote to memory of 1460	1812	payment details.exe	33

C:\Users\Admin\AppData\Local\Temp\payment details.exe
"C:\Users\Admin\AppData\Local\Temp\payment details.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\payment details.exe
  "{path}"
  2⤵
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\payment details.exe
  "{path}"
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\payment details.exe
  "{path}"
  2⤵
  PID:1468
- C:\Users\Admin\AppData\Local\Temp\payment details.exe
  "{path}"
  2⤵
  PID:1224
- C:\Users\Admin\AppData\Local\Temp\payment details.exe
  "{path}"
  2⤵
  PID:1460

memory/1812-60-0x00000000003D0000-0x00000000003D1000-memory.dmp

Download

memory/1812-62-0x0000000002010000-0x0000000002011000-memory.dmp

Download

memory/1812-63-0x00000000003A0000-0x00000000003A5000-memory.dmp

Download

memory/1812-64-0x0000000005450000-0x00000000054FD000-memory.dmp

Download

memory/1812-65-0x0000000000300000-0x000000000036F000-memory.dmp

Download