Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-02-2022 23:08
Static task
static1
Behavioral task
behavioral1
Sample
Calendario dei pagamenti.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
Calendario dei pagamenti.exe
-
Size
219KB
-
MD5
1a02db6595fb5471a1d91a4f51897269
-
SHA1
644069ab472309d4ecfca95de736dfb14676a776
-
SHA256
dd9c6267a87c89067d157e28d6f3ca17f958871f3d403609ed72dad80514e226
-
SHA512
ca86ca60343f96581c67ddaabd8553cfa030a1ae7cbedc0f05da403d972f7c2de9bf3048a0dbd43642c846f92f9c6f5b280f6537ef013a6d121fb70d72a2905d
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Calendario dei pagamenti.exedescription pid process target process PID 1692 set thread context of 1488 1692 Calendario dei pagamenti.exe Calendario dei pagamenti.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1492 1488 WerFault.exe Calendario dei pagamenti.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1492 WerFault.exe 1492 WerFault.exe 1492 WerFault.exe 1492 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1492 WerFault.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Calendario dei pagamenti.exepid process 1692 Calendario dei pagamenti.exe 1692 Calendario dei pagamenti.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1492 WerFault.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Calendario dei pagamenti.exeCalendario dei pagamenti.exedescription pid process target process PID 1692 wrote to memory of 1488 1692 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 1692 wrote to memory of 1488 1692 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 1692 wrote to memory of 1488 1692 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 1692 wrote to memory of 1488 1692 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 1692 wrote to memory of 1488 1692 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 1488 wrote to memory of 1492 1488 Calendario dei pagamenti.exe WerFault.exe PID 1488 wrote to memory of 1492 1488 Calendario dei pagamenti.exe WerFault.exe PID 1488 wrote to memory of 1492 1488 Calendario dei pagamenti.exe WerFault.exe PID 1488 wrote to memory of 1492 1488 Calendario dei pagamenti.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken