92fd046d9037a844e44c13dd287042186f7351f9a78779408bf71004e64dbbd3

Analysis

Target

Factura.exe
Size

524KB
MD5

9ce8e1a2f2f63a30c739ae2161a180ec
SHA1

937c3210cf4afc9f48a81b55c5d715f41bf6cfe6
SHA256

92fd046d9037a844e44c13dd287042186f7351f9a78779408bf71004e64dbbd3
SHA512

4b338f9441b43c8b592d2bf5ac3e25d2755d761b456ce6e9ac397416af7b1100f9e182758d1aebd9631bb981d2f2a807c27e30e51d2f0dd093bf335c9ff2bedb

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 1472 WerFault.exe Factura.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1184 WerFault.exe
1184 WerFault.exe
1184 WerFault.exe
1184 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1184 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1184 WerFault.exe

pid	pid_target	process	target process
1184	1472	WerFault.exe	Factura.exe

pid	process
1184	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1184	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Factura.exe

description	pid	process	target process
PID 1472 wrote to memory of 1184	1472	Factura.exe	WerFault.exe
PID 1472 wrote to memory of 1184	1472	Factura.exe	WerFault.exe
PID 1472 wrote to memory of 1184	1472	Factura.exe	WerFault.exe
PID 1472 wrote to memory of 1184	1472	Factura.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Factura.exe
"C:\Users\Admin\AppData\Local\Temp\Factura.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472

memory/1184-61-0x0000000000000000-mapping.dmp

Download
memory/1184-62-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1472-55-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/1472-57-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1472-58-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/1472-59-0x00000000006A0000-0x00000000006A8000-memory.dmp

Filesize
32KB

Download
memory/1472-60-0x0000000004BD0000-0x0000000004C39000-memory.dmp

Filesize
420KB

Download