32635c5f985aa62687009145f91b4523b781bea2faa94f7864d2ff16ab0a14ef

Analysis

Target

INVOICE#0909000.exe
Size

597KB
MD5

2fa857766a51190a35c523d1e668c419
SHA1

a03a3e40fea2601e2b745b6d111d8b50384f1bd5
SHA256

32635c5f985aa62687009145f91b4523b781bea2faa94f7864d2ff16ab0a14ef
SHA512

3c54fd2dcfce7e412b8fe2bf328b7feb22dc2eabc24b14040255b7844280c0b4e5d9860c3e244fd90e5702b51454a406039bfd4edd245ee0f530eac4ed191556

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	INVOICE#0909000.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1064	2000	INVOICE#0909000.exe	29
PID 2000 wrote to memory of 1064	2000	INVOICE#0909000.exe	29
PID 2000 wrote to memory of 1064	2000	INVOICE#0909000.exe	29
PID 2000 wrote to memory of 1064	2000	INVOICE#0909000.exe	29
PID 2000 wrote to memory of 2032	2000	INVOICE#0909000.exe	30
PID 2000 wrote to memory of 2032	2000	INVOICE#0909000.exe	30
PID 2000 wrote to memory of 2032	2000	INVOICE#0909000.exe	30
PID 2000 wrote to memory of 2032	2000	INVOICE#0909000.exe	30
PID 2000 wrote to memory of 1208	2000	INVOICE#0909000.exe	31
PID 2000 wrote to memory of 1208	2000	INVOICE#0909000.exe	31
PID 2000 wrote to memory of 1208	2000	INVOICE#0909000.exe	31
PID 2000 wrote to memory of 1208	2000	INVOICE#0909000.exe	31
PID 2000 wrote to memory of 1240	2000	INVOICE#0909000.exe	32
PID 2000 wrote to memory of 1240	2000	INVOICE#0909000.exe	32
PID 2000 wrote to memory of 1240	2000	INVOICE#0909000.exe	32
PID 2000 wrote to memory of 1240	2000	INVOICE#0909000.exe	32
PID 2000 wrote to memory of 1408	2000	INVOICE#0909000.exe	33
PID 2000 wrote to memory of 1408	2000	INVOICE#0909000.exe	33
PID 2000 wrote to memory of 1408	2000	INVOICE#0909000.exe	33
PID 2000 wrote to memory of 1408	2000	INVOICE#0909000.exe	33

C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe"
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe"
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe"
  2⤵
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe"
  2⤵
  PID:1240
- C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE#0909000.exe"
  2⤵
  PID:1408

memory/2000-59-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2000-61-0x0000000004880000-0x00000000048F1000-memory.dmp

Filesize
452KB

Download
memory/2000-62-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/2000-63-0x0000000000340000-0x000000000034F000-memory.dmp

Filesize
60KB

Download