2ea887962bbadf4eee463ff39c16b4ba40e06e0009e18a1ea11f14902a3dd253

Analysis

Target
June new invoice.exe
Size 242KB
Sample220601-jd51ssfce8
SHA256 2ea887962bbadf4eee463ff39c16b4ba40e06e0009e18a1ea11f14902a3dd253
MD5 0dbb7ebee977112f3d22ddcb81e117ff
SHA1 a5eb149c0e7b6f9191914d53692164b431fc4702
SHA512 a833475236e4c46a672d9f888d60801d43078ae4d0d50542d50299a544ebc3391d1f38a572764977c9f0ce7d9264b2e53baae0a0a8ea3d71f1b16a9a41077256
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	June new invoice.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 4788	4344	June new invoice.exe	86
PID 4344 wrote to memory of 4788	4344	June new invoice.exe	86
PID 4344 wrote to memory of 4788	4344	June new invoice.exe	86
PID 4344 wrote to memory of 3396	4344	June new invoice.exe	87
PID 4344 wrote to memory of 3396	4344	June new invoice.exe	87
PID 4344 wrote to memory of 3396	4344	June new invoice.exe	87
PID 4344 wrote to memory of 3612	4344	June new invoice.exe	88
PID 4344 wrote to memory of 3612	4344	June new invoice.exe	88
PID 4344 wrote to memory of 3612	4344	June new invoice.exe	88
PID 4344 wrote to memory of 2212	4344	June new invoice.exe	89
PID 4344 wrote to memory of 2212	4344	June new invoice.exe	89
PID 4344 wrote to memory of 2212	4344	June new invoice.exe	89
PID 4344 wrote to memory of 4360	4344	June new invoice.exe	90
PID 4344 wrote to memory of 4360	4344	June new invoice.exe	90
PID 4344 wrote to memory of 4360	4344	June new invoice.exe	90

C:\Users\Admin\AppData\Local\Temp\June new invoice.exe
"C:\Users\Admin\AppData\Local\Temp\June new invoice.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  PID:4788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  PID:3396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  PID:3612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
  2⤵
  PID:4360

memory/4344-130-0x00000000002D0000-0x0000000000310000-memory.dmp

Download