0115201f17cb83a2bcf49068ab1437103a63b9ae2895640ddde30f74dfcb42ad

Analysis

Target

Payment.exe
Size

149KB
MD5

46a9cde2229b45d390ad40ce0cc997f9
SHA1

ddf3a356e42d2a15ccd930b0d5c6d7077824ef8f
SHA256

4c4a0595a5ac3499e7d398aa9cbbea5fc5a77836be706c50bbae6dd7c0c6aadb
SHA512

75a082b7a9a0df0a2b9f26fffcf8592f13d46c2b5bffc8830a100efcdd4cfa8394bb2a567f74c4c890f4f9cdcdeb103900cbb2990494971a119e2d128910340f

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

608 1368 WerFault.exe Payment.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

608 WerFault.exe
608 WerFault.exe
608 WerFault.exe
608 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Payment.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1368 Payment.exe
Token: SeDebugPrivilege 608 WerFault.exe

pid	pid_target	process	target process
608	1368	WerFault.exe	Payment.exe

description	pid	process
Token: SeDebugPrivilege	1368	Payment.exe
Token: SeDebugPrivilege	608	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Payment.exe

description	pid	process	target process
PID 1368 wrote to memory of 608	1368	Payment.exe	WerFault.exe
PID 1368 wrote to memory of 608	1368	Payment.exe	WerFault.exe
PID 1368 wrote to memory of 608	1368	Payment.exe	WerFault.exe
PID 1368 wrote to memory of 608	1368	Payment.exe	WerFault.exe

memory/608-57-0x0000000000000000-mapping.dmp

Download
memory/608-58-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1368-53-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1368-55-0x00000000768C1000-0x00000000768C3000-memory.dmp

Filesize
8KB

Download
memory/1368-56-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download