93d900164f8df22ed262ffba777f1138271b7c5982948c0e8115e59a3dce41ee

Analysis

max time kernel
56s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 07:20

Target

美元存款余额.exe
Size

680KB
MD5

8342718b1c3f943c2fe7b991f5fdaeab
SHA1

a9fee27b56fd3c73dc5d604cbacef90baa7a38f1
SHA256

93d900164f8df22ed262ffba777f1138271b7c5982948c0e8115e59a3dce41ee
SHA512

7301f9e5bdc5a961262c4bd8128a666803ad2b04143fc332e516413708dd74459472efc964f7854bd5ccbf7b15ddc27a7ebbdb668e41fbe6a011f4304636d496
SSDEEP

12288:emTgkcrgPrkEkSXb90U1cVixDrGSelJ6Hx7IU+cxcovTek6iZ9Q9T2:ey9crU9L90+E6GSelexkcionpyS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
520	836	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
836	美元存款余额.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	美元存款余额.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 520	836	美元存款余额.exe	27
PID 836 wrote to memory of 520	836	美元存款余额.exe	27
PID 836 wrote to memory of 520	836	美元存款余额.exe	27
PID 836 wrote to memory of 520	836	美元存款余额.exe	27

C:\Users\Admin\AppData\Local\Temp\美元存款余额.exe
"C:\Users\Admin\AppData\Local\Temp\美元存款余额.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 696
  2⤵
  - Program crash
  PID:520

memory/836-54-0x0000000000290000-0x000000000033E000-memory.dmp

Filesize
696KB

Download
memory/836-55-0x0000000004450000-0x0000000004490000-memory.dmp

Filesize
256KB

Download
memory/836-56-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/836-57-0x0000000004450000-0x0000000004490000-memory.dmp

Filesize
256KB

Download
memory/836-58-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/836-59-0x00000000043A0000-0x0000000004410000-memory.dmp

Filesize
448KB

Download
memory/836-60-0x0000000004410000-0x0000000004448000-memory.dmp

Filesize
224KB

Download