0c63172bdfe14f19a76c34ce3d9528761fc2e3b7e39d9a10ad5ee8a64cd79f29

Analysis

Target

PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe
Size

592KB
MD5

f228daa5647666d29fd8a3450293867b
SHA1

71a0babceaa1cbda858383be9daeac2dd0ab0d21
SHA256

0c63172bdfe14f19a76c34ce3d9528761fc2e3b7e39d9a10ad5ee8a64cd79f29
SHA512

cf9f75b4752014a56c857957144496565448c6e1ef13b44ee0a84690ae04b7dd7ba5756a890051cd2433513916b6d6b767674482326d7c0fc2bbb2d91c7bcfc6

Score

9^/10

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/368-62-0x0000000000600000-0x0000000000605000-memory.dmp	CustAttr

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1624 368 WerFault.exe PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1624 WerFault.exe
1624 WerFault.exe
1624 WerFault.exe
1624 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1624 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1624 WerFault.exe

pid	pid_target	process	target process
1624	368	WerFault.exe	PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe

pid	process
1624	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1624	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe

description	pid	process	target process
PID 368 wrote to memory of 1624	368	PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe	WerFault.exe
PID 368 wrote to memory of 1624	368	PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe	WerFault.exe
PID 368 wrote to memory of 1624	368	PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe	WerFault.exe
PID 368 wrote to memory of 1624	368	PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVISE HSBC INTERNATIONAL_pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 644
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1624

memory/368-59-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/368-61-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/368-62-0x0000000000600000-0x0000000000605000-memory.dmp

Filesize
20KB

Download
memory/1624-63-0x0000000000000000-mapping.dmp

Download
memory/1624-64-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download