b0b986ed5654b0bc08243773c2c57558c3d1e1158f6744eafd7c9357bf2d401c

Analysis

Target

Payment Advice.pdf.exe
Size

370KB
MD5

5cda0b468d4136fb19e1f79c258acbb9
SHA1

0cb7a1174cf5d5a7089c8ed585c5e670974b9048
SHA256

fa5511f4b07ca39be9b04bee49a2b103cf827a207d316d4d41bad9cede43c9bc
SHA512

e05c563a4caf8aa1def8febbe0042cd97b8b08ff2c6a69215610b321fb77132f6f9f6d804cba0d2cc060e7d81789d379475b03b107087555f717809f51784f44

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

576 1516 WerFault.exe Payment Advice.pdf.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

576 WerFault.exe
576 WerFault.exe
576 WerFault.exe
576 WerFault.exe
576 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

576 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Payment Advice.pdf.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1516 Payment Advice.pdf.exe
Token: SeDebugPrivilege 576 WerFault.exe

pid	pid_target	process	target process
576	1516	WerFault.exe	Payment Advice.pdf.exe

pid	process
576	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1516	Payment Advice.pdf.exe
Token: SeDebugPrivilege	576	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Payment Advice.pdf.exe

description	pid	process	target process
PID 1516 wrote to memory of 576	1516	Payment Advice.pdf.exe	WerFault.exe
PID 1516 wrote to memory of 576	1516	Payment Advice.pdf.exe	WerFault.exe
PID 1516 wrote to memory of 576	1516	Payment Advice.pdf.exe	WerFault.exe

memory/576-56-0x000007FEFB611000-0x000007FEFB613000-memory.dmp

Filesize
8KB

Download
memory/576-57-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/1516-54-0x000000013F8C0000-0x000000013F920000-memory.dmp

Filesize
384KB

Download
memory/1516-55-0x000000001C1A0000-0x000000001C1A2000-memory.dmp

Filesize
8KB

Download