e5f9ad28d453a801995d0505222189cfcb86ea7baa429979c21f85ca11adf7fc

Analysis

Target

proforma invoice packing list.exe
Size

634KB
MD5

48fb8e04e65715d3b3061ae94cd2c05d
SHA1

3b902deb417733907561e79706a4834e754231b7
SHA256

e5f9ad28d453a801995d0505222189cfcb86ea7baa429979c21f85ca11adf7fc
SHA512

c7213cc8e34fca207a3f01f3f3d79a502345f576d32361465f899f68758e29d301491ad4d96fba83c7bdeff66cf3bd4dc79663654501f426b8e58122b3f27eb6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

868 1124 WerFault.exe proforma invoice packing list.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
868 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

868 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 868 WerFault.exe

pid	pid_target	process	target process
868	1124	WerFault.exe	proforma invoice packing list.exe

pid	process
868	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	868	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

proforma invoice packing list.exe

description	pid	process	target process
PID 1124 wrote to memory of 868	1124	proforma invoice packing list.exe	WerFault.exe
PID 1124 wrote to memory of 868	1124	proforma invoice packing list.exe	WerFault.exe
PID 1124 wrote to memory of 868	1124	proforma invoice packing list.exe	WerFault.exe
PID 1124 wrote to memory of 868	1124	proforma invoice packing list.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\proforma invoice packing list.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoice packing list.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

memory/868-61-0x0000000000000000-mapping.dmp

Download
memory/868-62-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1124-55-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/1124-57-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1124-58-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1124-59-0x0000000000AD0000-0x0000000000AD6000-memory.dmp

Filesize
24KB

Download
memory/1124-60-0x0000000005D90000-0x0000000005E24000-memory.dmp

Filesize
592KB

Download