212cb7a1b5b7d323d0c06d19c79c35a65fcb805c429132618828b5e7b29796a9

Analysis

Target

支払い命令.exe
Size

541KB
MD5

f5fabfdc406897f2026193d2c50f9e33
SHA1

57c68b743c7f80c2365ddfff0e0c2253b2cc0628
SHA256

b64a7759ecf0ee5e886d56faa7dc557f0a1b06f63c39cc2f96feb1e8dd150c94
SHA512

222e882cb32c25998888dfbb4f9c415ff69ce285fabb8ffdc1a3dc0f7ec7210b46cdf751b39c7e75bd3a7280f85f1997d25c528feaef0b7f48c355aa4d35724d

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1372 840 WerFault.exe 支払い命令.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

支払い命令.exeWerFault.exe

pid process

840 支払い命令.exe
1372 WerFault.exe
1372 WerFault.exe
1372 WerFault.exe
1372 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

支払い命令.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 840 支払い命令.exe
Token: SeDebugPrivilege 1372 WerFault.exe

pid	pid_target	process	target process
1372	840	WerFault.exe	支払い命令.exe

description	pid	process
Token: SeDebugPrivilege	840	支払い命令.exe
Token: SeDebugPrivilege	1372	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

支払い命令.exe

description	pid	process	target process
PID 840 wrote to memory of 1372	840	支払い命令.exe	WerFault.exe
PID 840 wrote to memory of 1372	840	支払い命令.exe	WerFault.exe
PID 840 wrote to memory of 1372	840	支払い命令.exe	WerFault.exe
PID 840 wrote to memory of 1372	840	支払い命令.exe	WerFault.exe

memory/840-55-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/840-57-0x0000000076081000-0x0000000076083000-memory.dmp

Filesize
8KB

Download
memory/840-58-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/840-59-0x00000000004E0000-0x00000000004E7000-memory.dmp

Filesize
28KB

Download
memory/840-60-0x0000000004E30000-0x0000000004E88000-memory.dmp

Filesize
352KB

Download
memory/1372-61-0x0000000000000000-mapping.dmp

Download
memory/1372-62-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download