18e4b85fb1d19d14068cf9e1e09b964645aec58197471b35c0b3a7ad8fd4d219

Analysis

Target

Pago completo____________________________________________________________________.bat.exe
Size

602KB
MD5

534bc2255d22103f83e23dbedad55b81
SHA1

b6765b159f732befe3834a2e8d253bc15a6397e6
SHA256

18e4b85fb1d19d14068cf9e1e09b964645aec58197471b35c0b3a7ad8fd4d219
SHA512

97bce47399ac42b87bf1c6641830e0cdb6ce16cfe7255d1a22cdbbdcfe69020e3966cb045f9c33a0bcf47d8066f94a71607b5ceb3ef062907c040dfd731b7453

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1368 1900 WerFault.exe Pago completo____________________________________________________________________.bat.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1368 WerFault.exe
1368 WerFault.exe
1368 WerFault.exe
1368 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1368 WerFault.exe

pid	pid_target	process	target process
1368	1900	WerFault.exe	Pago completo____________________________________________________________________.bat.exe

description	pid	process
Token: SeDebugPrivilege	1368	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Pago completo____________________________________________________________________.bat.exe

description	pid	process	target process
PID 1900 wrote to memory of 1368	1900	Pago completo____________________________________________________________________.bat.exe	WerFault.exe
PID 1900 wrote to memory of 1368	1900	Pago completo____________________________________________________________________.bat.exe	WerFault.exe
PID 1900 wrote to memory of 1368	1900	Pago completo____________________________________________________________________.bat.exe	WerFault.exe
PID 1900 wrote to memory of 1368	1900	Pago completo____________________________________________________________________.bat.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Pago completo____________________________________________________________________.bat.exe
"C:\Users\Admin\AppData\Local\Temp\Pago completo____________________________________________________________________.bat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

memory/1368-60-0x0000000000000000-mapping.dmp

Download
memory/1368-61-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1900-55-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1900-57-0x0000000007150000-0x0000000007151000-memory.dmp

Filesize
4KB

Download
memory/1900-58-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/1900-59-0x0000000007AB0000-0x0000000007B19000-memory.dmp

Filesize
420KB

Download