2ba67828100783fb3af5fbc628bb63d451cce5c93ac372e68993a8146a2cca4d

Analysis

Target

Orden de compra Nº TM21-12-03.exe,pdf.exe
Size

425KB
MD5

f4b12b5adde064ae3797b5657b20ea97
SHA1

30a72ab9a4d73eb3118eec5ce62235d2583105b0
SHA256

2ba67828100783fb3af5fbc628bb63d451cce5c93ac372e68993a8146a2cca4d
SHA512

e9d5280c9e0bf29a6f2e71443f993cdfec720dbb6ff7cdd625214035985eb9d9e675093b7be86f04b82132e3fad6e3c4338945974ae3d5d0ab89e7ddb9fbe4b3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

512 784 WerFault.exe Orden de compra Nº TM21-12-03.exe,pdf.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

512 WerFault.exe
512 WerFault.exe
512 WerFault.exe
512 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 512 WerFault.exe

pid	pid_target	process	target process
512	784	WerFault.exe	Orden de compra Nº TM21-12-03.exe,pdf.exe

description	pid	process
Token: SeDebugPrivilege	512	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Orden de compra Nº TM21-12-03.exe,pdf.exe

description	pid	process	target process
PID 784 wrote to memory of 512	784	Orden de compra Nº TM21-12-03.exe,pdf.exe	WerFault.exe
PID 784 wrote to memory of 512	784	Orden de compra Nº TM21-12-03.exe,pdf.exe	WerFault.exe
PID 784 wrote to memory of 512	784	Orden de compra Nº TM21-12-03.exe,pdf.exe	WerFault.exe
PID 784 wrote to memory of 512	784	Orden de compra Nº TM21-12-03.exe,pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Orden de compra Nº TM21-12-03.exe,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Orden de compra Nº TM21-12-03.exe,pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:784

memory/512-61-0x0000000000000000-mapping.dmp

Download
memory/512-62-0x0000000000BD0000-0x0000000000C40000-memory.dmp

Filesize
448KB

Download
memory/784-55-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/784-57-0x0000000075F41000-0x0000000075F43000-memory.dmp

Filesize
8KB

Download
memory/784-58-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/784-59-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/784-60-0x00000000021E0000-0x000000000222A000-memory.dmp

Filesize
296KB

Download