2cf586182f56dcc1131459031b5dca2b6c3037f5c8bc39b70ab226972b5d3d9d

Analysis

Target
Bank Slip.exe
Size 609KB
Sample211201-lbcbtaeca6
SHA256 2cf586182f56dcc1131459031b5dca2b6c3037f5c8bc39b70ab226972b5d3d9d
MD5 23415766fdffe2d1e3df520326e3326c
SHA1 e1d773dbd8164c620b926d1f9bcfde9910840b8b
SHA512 2ab7d544257ecacbad91e5185d8e087728d9d3ffda3300458a6f82720743c1eddad3b55bc51f2d8c015dc0cfabab5ff676ebc36612f4187f64f1be0c018061d0
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
360	1588	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
360	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	360	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 360	1588	Bank Slip.exe	28
PID 1588 wrote to memory of 360	1588	Bank Slip.exe	28
PID 1588 wrote to memory of 360	1588	Bank Slip.exe	28
PID 1588 wrote to memory of 360	1588	Bank Slip.exe	28

C:\Users\Admin\AppData\Local\Temp\Bank Slip.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Slip.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 676
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:360

memory/360-62-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/1588-55-0x00000000011D0000-0x00000000011D1000-memory.dmp

Download

memory/1588-57-0x0000000075731000-0x0000000075733000-memory.dmp

Download

memory/1588-58-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/1588-59-0x00000000005D0000-0x00000000005D6000-memory.dmp

Download

memory/1588-60-0x0000000007C60000-0x0000000007CEF000-memory.dmp

Download