3d078815c5f303d119acfa9841d049f26deeaa17870964900f9767071fc00c18

Analysis

Target

NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe
Size

443KB
MD5

50dec39b9fc88b00ce024d65b35e1038
SHA1

f9ab13a600bb3a8d2c0c83e89951fb88a314df22
SHA256

3d078815c5f303d119acfa9841d049f26deeaa17870964900f9767071fc00c18
SHA512

242380c3cf85b952ff014cf148d1c8a17b4e06cc1ee25024a7bf94c712da39df1b0af8106570f42b43d182d1a2234e8a3849cff63f53537e0974c0b75d38069c

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

616 948 WerFault.exe NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

616 WerFault.exe
616 WerFault.exe
616 WerFault.exe
616 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 616 WerFault.exe

pid	pid_target	process	target process
616	948	WerFault.exe	NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe

description	pid	process
Token: SeDebugPrivilege	616	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe

description	pid	process	target process
PID 948 wrote to memory of 616	948	NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe	WerFault.exe
PID 948 wrote to memory of 616	948	NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe	WerFault.exe
PID 948 wrote to memory of 616	948	NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe	WerFault.exe
PID 948 wrote to memory of 616	948	NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR JANUARY 2021 #02453.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:948

memory/616-61-0x0000000000000000-mapping.dmp

Download
memory/616-62-0x0000000000210000-0x0000000000286000-memory.dmp

Filesize
472KB

Download
memory/948-55-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/948-57-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/948-58-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/948-59-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/948-60-0x0000000007D30000-0x0000000007D98000-memory.dmp

Filesize
416KB

Download