d0d44473617c827906fb10fd9212e9ead8ec202d3e15e967441d328e798e6d47

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 18:57

Target

Payment MT103 Swift 77890546122.exe
Size

6KB
MD5

3c08828762a142e67b6b2a63ba84236e
SHA1

82337cae12f2c6b6d1d0770bf52b794bebe6a18a
SHA256

d0d44473617c827906fb10fd9212e9ead8ec202d3e15e967441d328e798e6d47
SHA512

afef20e099f3dcf561dbef4bc585390414124ce7e639c07fe75229fd4d6af122d7e9ad92a5c84ed9240ee3b6671045481efc7ef9703b092094cc0fc80af29c43
SSDEEP

48:6XXjZQaJRuDl5ditfzJCN8PqYG065Uwzw+PeLlz3tPnUM4+z9w4k7DgH0LPKD4vS:SZmdwI8rHcPeprtf4+z9wSD3BCzNt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	4972	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	Payment MT103 Swift 77890546122.exe

C:\Users\Admin\AppData\Local\Temp\Payment MT103 Swift 77890546122.exe
"C:\Users\Admin\AppData\Local\Temp\Payment MT103 Swift 77890546122.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 1896
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:3944

memory/4972-0-0x0000000000BA0000-0x0000000000BA8000-memory.dmp

Filesize
32KB

Download
memory/4972-1-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download
memory/4972-2-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/4972-3-0x00000000749F0000-0x00000000751A0000-memory.dmp

Filesize
7.7MB

Download