827cccb1a82b2c9b9391f38bc6ff3fb6ce41f3a4b9db17da871ca56393ade754

Analysis

Target

Overdue Invoice.exe
Size

606KB
MD5

70755074866112b39a6a999612898661
SHA1

086a019502389944d5449ced3b004fca5dc27f4e
SHA256

827cccb1a82b2c9b9391f38bc6ff3fb6ce41f3a4b9db17da871ca56393ade754
SHA512

45b45c73c6ce3c363d966dc9fbbd202c6657f13f9fdfe1ba59d569eda5e45fd0fb95b55ac784469bf660683f6d1163b91c8a66c5e6f26a275bec4310e7e2ae11

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

612 1116 WerFault.exe Overdue Invoice.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

612 WerFault.exe
612 WerFault.exe
612 WerFault.exe
612 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 612 WerFault.exe

pid	pid_target	process	target process
612	1116	WerFault.exe	Overdue Invoice.exe

description	pid	process
Token: SeDebugPrivilege	612	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Overdue Invoice.exe

description	pid	process	target process
PID 1116 wrote to memory of 612	1116	Overdue Invoice.exe	WerFault.exe
PID 1116 wrote to memory of 612	1116	Overdue Invoice.exe	WerFault.exe
PID 1116 wrote to memory of 612	1116	Overdue Invoice.exe	WerFault.exe
PID 1116 wrote to memory of 612	1116	Overdue Invoice.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Overdue Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Overdue Invoice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

memory/612-61-0x0000000000000000-mapping.dmp

Download
memory/612-62-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1116-55-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/1116-57-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download
memory/1116-58-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/1116-59-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/1116-60-0x0000000004E30000-0x0000000004EB1000-memory.dmp

Filesize
516KB

Download