167c0ee245fd2797cedb1fdc049d295f75d24a59c48a715a0a27e9508134dd67

Analysis

Target

Overdue outstanding payment.exe
Size

529KB
MD5

531e86d55ddb922cd268147ac004f604
SHA1

ea2dc2bf2a84d3f0aae358a0951e962ee8418f82
SHA256

d34b4cfc530b91d44ba82a15cdb948e4424e30ee57245f4792c8303d202df173
SHA512

c58a1a1c5af776464473bd66a1e0f04ebcc749bf2a3b0c346ab6b3c64aac59c28f31a1b45d4c739edc8e578c2055a757c498b20a0f674eef7ea3369e9382934b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

364 1504 WerFault.exe Overdue outstanding payment.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

364 WerFault.exe
364 WerFault.exe
364 WerFault.exe
364 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

364 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 364 WerFault.exe

pid	pid_target	process	target process
364	1504	WerFault.exe	Overdue outstanding payment.exe

pid	process
364	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	364	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Overdue outstanding payment.exe

description	pid	process	target process
PID 1504 wrote to memory of 364	1504	Overdue outstanding payment.exe	WerFault.exe
PID 1504 wrote to memory of 364	1504	Overdue outstanding payment.exe	WerFault.exe
PID 1504 wrote to memory of 364	1504	Overdue outstanding payment.exe	WerFault.exe
PID 1504 wrote to memory of 364	1504	Overdue outstanding payment.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Overdue outstanding payment.exe
"C:\Users\Admin\AppData\Local\Temp\Overdue outstanding payment.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

memory/364-61-0x0000000000000000-mapping.dmp

Download
memory/364-62-0x00000000002C0000-0x000000000034A000-memory.dmp

Filesize
552KB

Download
memory/1504-55-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/1504-57-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1504-58-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/1504-59-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/1504-60-0x0000000005250000-0x00000000052B9000-memory.dmp

Filesize
420KB

Download