d8cfa5a0ddbf5483a170f0a66b6579ddb1cac3e50cb784ea2db0a2d91717abc8

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 09:10

Target

счет для получения платежа.exe
Size

755KB
MD5

98468a6042ad697625cb74fd9a055f81
SHA1

3054c30f272be1a98bc41189132070bf9713b7b5
SHA256

92f371959bbb273fc41afa0befcbfed0f3d5679062d216fe3804048228c79003
SHA512

c6be1e496bf1f22a2b9a9abb0a69d25992d739cfab973069ec21e7fcea1018e15fff50141e7936a5bbe523363bcccab16800b637e1a09ee74aa68f8559544115
SSDEEP

12288:SIqWET/mr9K+22BEEzFatniEvYSUjyC7UxpWT3fbBI+hecKpzhzVA19kVXB:eWtb3BE23QWbmSeDplzVzVX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	4888	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4888	счет для получения платежа.exe
4888	счет для получения платежа.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	счет для получения платежа.exe

C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe
"C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 1180
  2⤵
  - Program crash
  PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4888 -ip 4888
1⤵
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3032

memory/4888-0-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

Filesize
4KB

Download
memory/4888-1-0x0000000000540000-0x0000000000604000-memory.dmp

Filesize
784KB

Download
memory/4888-2-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/4888-3-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/4888-4-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/4888-5-0x00000000050A0000-0x00000000050AA000-memory.dmp

Filesize
40KB

Download
memory/4888-6-0x00000000079F0000-0x0000000007A12000-memory.dmp

Filesize
136KB

Download
memory/4888-7-0x0000000005130000-0x000000000513C000-memory.dmp

Filesize
48KB

Download
memory/4888-8-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/4888-9-0x00000000028E0000-0x0000000002962000-memory.dmp

Filesize
520KB

Download
memory/4888-10-0x0000000010B50000-0x0000000010BEC000-memory.dmp

Filesize
624KB

Download
memory/4888-11-0x0000000074DDE000-0x0000000074DDF000-memory.dmp

Filesize
4KB

Download
memory/4888-12-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download
memory/4888-13-0x0000000074DD0000-0x0000000075580000-memory.dmp

Filesize
7.7MB

Download