d8ed1732f84e3e0a0b6d079afee1c5da08a6cf2fd257fca87ff5172f98a696df

Analysis

Target
cotización.exe
Size 379KB
Sample211101-lfb7lsebfl
SHA256 d8ed1732f84e3e0a0b6d079afee1c5da08a6cf2fd257fca87ff5172f98a696df
MD5 b700ef802831d1a09a05ae0e94c6a520
SHA1 0a47dad399f49f2f641c395ae6b82185af709d47
SHA512 7509b8ed558cff746c03dd47a2b03c2685cb73f8ea3baabcd860f22f287daf51dd5874c553ac684b28c3ba67c061db17e2392a7250f72510df4ed88a09ee3228
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	1148	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
532	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	532	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 532	1148	cotización.exe	28
PID 1148 wrote to memory of 532	1148	cotización.exe	28
PID 1148 wrote to memory of 532	1148	cotización.exe	28
PID 1148 wrote to memory of 532	1148	cotización.exe	28

C:\Users\Admin\AppData\Local\Temp\cotización.exe
"C:\Users\Admin\AppData\Local\Temp\cotización.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 660
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:532

memory/532-60-0x0000000000200000-0x0000000000201000-memory.dmp

Download

memory/1148-55-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/1148-57-0x00000000762D1000-0x00000000762D3000-memory.dmp

Download

memory/1148-58-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download