0e3bcfa68092483cc3e298c0207a64b44b3d381957b583fba84972a8c8c3fcf7

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 10:02

Target

Payment Invoice.exe
Size

838KB
MD5

981ba70a3fdcffd8179106b018bec5af
SHA1

d9a0eed1e76872e09c05a81907bbff1bc26dc947
SHA256

1aa3a55aa9fcb60498c10f1f4a51d4de8fb0428a6b21e8b09ce7f75b45bdfd1c
SHA512

0fab6423f4e6401a0593dd476dbcbce398ef56f3699fa89f8e1ca2772d3f53c8e938fe255d5aaf3875d3ad02c2592f8f19ccdb3ce80f55e509ce2b1b1feccc4f
SSDEEP

12288:cZfOZ1VGG8PfPV4HBfjVpjm2PtHBT6Br21s3wfKSTwga6UaorIcT:YWZ6H398tjVF9thmZp3H1F

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	2092	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2092	Payment Invoice.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	Payment Invoice.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2180	2092	Payment Invoice.exe	30
PID 2092 wrote to memory of 2180	2092	Payment Invoice.exe	30
PID 2092 wrote to memory of 2180	2092	Payment Invoice.exe	30
PID 2092 wrote to memory of 2180	2092	Payment Invoice.exe	30

C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 716
  2⤵
  - Program crash
  PID:2180

memory/2092-0-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-1-0x0000000000C90000-0x0000000000D66000-memory.dmp

Filesize
856KB

Download
memory/2092-2-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2092-3-0x0000000004E80000-0x0000000004EC0000-memory.dmp

Filesize
256KB

Download
memory/2092-4-0x00000000008C0000-0x00000000008D4000-memory.dmp

Filesize
80KB

Download
memory/2092-5-0x0000000004E80000-0x0000000004EC0000-memory.dmp

Filesize
256KB

Download
memory/2092-6-0x00000000008F0000-0x00000000008FE000-memory.dmp

Filesize
56KB

Download
memory/2092-7-0x0000000005870000-0x0000000005912000-memory.dmp

Filesize
648KB

Download