69f3fe2cb60ac42ef8c40632555435044fac763f32f16dc3834fcaa0b9c1ee8f

Analysis

Target

payment copy.exe
Size

337KB
MD5

7ff711fce0553fa21e4e305253d2018c
SHA1

f06a20b3b4051b1a04282ac6f902d5f3a7263a61
SHA256

86527ddc54f19b87b4c39279d96bead8f58a9961e0115d7ff12719b688f12df5
SHA512

714e766e57424c693f24012044b582c681582cc86e65f6b22757baca0613a3f2a3a4d5c7766a8fde57a75fe3614fd21f9259f5ea5b1334064aa6fcd746f87a0a

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1920 1860 WerFault.exe payment copy.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1920 WerFault.exe
1920 WerFault.exe
1920 WerFault.exe
1920 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1920 WerFault.exe

pid	pid_target	process	target process
1920	1860	WerFault.exe	payment copy.exe

description	pid	process
Token: SeDebugPrivilege	1920	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

payment copy.exe

description	pid	process	target process
PID 1860 wrote to memory of 1920	1860	payment copy.exe	WerFault.exe
PID 1860 wrote to memory of 1920	1860	payment copy.exe	WerFault.exe
PID 1860 wrote to memory of 1920	1860	payment copy.exe	WerFault.exe
PID 1860 wrote to memory of 1920	1860	payment copy.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\payment copy.exe
"C:\Users\Admin\AppData\Local\Temp\payment copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

memory/1860-55-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/1860-57-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/1860-58-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/1860-59-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/1860-60-0x0000000004630000-0x0000000004674000-memory.dmp

Filesize
272KB

Download
memory/1920-61-0x0000000000000000-mapping.dmp

Download
memory/1920-62-0x00000000001F0000-0x0000000000250000-memory.dmp

Filesize
384KB

Download