8ad914219379a6db831fd45a793fd805285d7d213efe2eff0dc638560fc5e436

Analysis

Target

Orden de Compra -AR95647.exe,pdf.exe
Size

499KB
MD5

b78d79171c13865b852b4460305c1627
SHA1

d0e47aab1ffe61e6292813cafdf110c5c506212c
SHA256

8ad914219379a6db831fd45a793fd805285d7d213efe2eff0dc638560fc5e436
SHA512

cd96ad37eeafd8ab70b044b97b2a4c785f67981c616680484c12279f2fb2187d35a7c34489f350cc52ad20b3e5833127ce8fa3a3029ec2d24b348490f7c11417

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

568 1560 WerFault.exe Orden de Compra -AR95647.exe,pdf.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

568 WerFault.exe
568 WerFault.exe
568 WerFault.exe
568 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 568 WerFault.exe

pid	pid_target	process	target process
568	1560	WerFault.exe	Orden de Compra -AR95647.exe,pdf.exe

description	pid	process
Token: SeDebugPrivilege	568	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Orden de Compra -AR95647.exe,pdf.exe

description	pid	process	target process
PID 1560 wrote to memory of 568	1560	Orden de Compra -AR95647.exe,pdf.exe	WerFault.exe
PID 1560 wrote to memory of 568	1560	Orden de Compra -AR95647.exe,pdf.exe	WerFault.exe
PID 1560 wrote to memory of 568	1560	Orden de Compra -AR95647.exe,pdf.exe	WerFault.exe
PID 1560 wrote to memory of 568	1560	Orden de Compra -AR95647.exe,pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Orden de Compra -AR95647.exe,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Orden de Compra -AR95647.exe,pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560

memory/568-61-0x0000000000000000-mapping.dmp

Download
memory/568-62-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1560-55-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/1560-57-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1560-58-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/1560-59-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1560-60-0x0000000004DA0000-0x0000000004E09000-memory.dmp

Filesize
420KB

Download