4952674eee9adeccc538811c244e3f90bb71b2bc249a1c4f0b36f93ca77f364a

Analysis

Target

PAYMENT PROOF.exe
Size

737KB
MD5

fdcbddac3d52773f6d1af78f53805169
SHA1

a6e4fbd6362f23c9ff160d2370023faec1c523c4
SHA256

4952674eee9adeccc538811c244e3f90bb71b2bc249a1c4f0b36f93ca77f364a
SHA512

6bc8b0522175d77c7297e4824e44cf9b95cc6add9b0f4acc0f16d58e44aede3390553d05469a5e15f33dd326ed0c44979c4b84e7e940c02180acd5712e20337e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

820 952 WerFault.exe PAYMENT PROOF.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

820 WerFault.exe
820 WerFault.exe
820 WerFault.exe
820 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

820 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 820 WerFault.exe

pid	pid_target	process	target process
820	952	WerFault.exe	PAYMENT PROOF.exe

pid	process
820	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	820	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PAYMENT PROOF.exe

description	pid	process	target process
PID 952 wrote to memory of 820	952	PAYMENT PROOF.exe	WerFault.exe
PID 952 wrote to memory of 820	952	PAYMENT PROOF.exe	WerFault.exe
PID 952 wrote to memory of 820	952	PAYMENT PROOF.exe	WerFault.exe
PID 952 wrote to memory of 820	952	PAYMENT PROOF.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT PROOF.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT PROOF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952

memory/820-61-0x0000000000000000-mapping.dmp

Download
memory/820-62-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/952-55-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/952-57-0x0000000076431000-0x0000000076433000-memory.dmp

Filesize
8KB

Download
memory/952-58-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/952-59-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/952-60-0x0000000005060000-0x0000000005104000-memory.dmp

Filesize
656KB

Download