d8cfa5a0ddbf5483a170f0a66b6579ddb1cac3e50cb784ea2db0a2d91717abc8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 09:10

Target

счет для получения платежа.exe
Size

755KB
MD5

98468a6042ad697625cb74fd9a055f81
SHA1

3054c30f272be1a98bc41189132070bf9713b7b5
SHA256

92f371959bbb273fc41afa0befcbfed0f3d5679062d216fe3804048228c79003
SHA512

c6be1e496bf1f22a2b9a9abb0a69d25992d739cfab973069ec21e7fcea1018e15fff50141e7936a5bbe523363bcccab16800b637e1a09ee74aa68f8559544115
SSDEEP

12288:SIqWET/mr9K+22BEEzFatniEvYSUjyC7UxpWT3fbBI+hecKpzhzVA19kVXB:eWtb3BE23QWbmSeDplzVzVX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	2272	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2272	счет для получения платежа.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	счет для получения платежа.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2680	2272	счет для получения платежа.exe	28
PID 2272 wrote to memory of 2680	2272	счет для получения платежа.exe	28
PID 2272 wrote to memory of 2680	2272	счет для получения платежа.exe	28
PID 2272 wrote to memory of 2680	2272	счет для получения платежа.exe	28

C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe
"C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 692
  2⤵
  - Program crash
  PID:2680

memory/2272-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x00000000008C0000-0x0000000000984000-memory.dmp

Filesize
784KB

Download
memory/2272-2-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2272-3-0x0000000000600000-0x0000000000622000-memory.dmp

Filesize
136KB

Download
memory/2272-4-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/2272-5-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/2272-6-0x0000000005270000-0x00000000052F2000-memory.dmp

Filesize
520KB

Download
memory/2272-7-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/2272-8-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download