d8cfa5a0ddbf5483a170f0a66b6579ddb1cac3e50cb784ea2db0a2d91717abc8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 09:10

Target

счет для получения платежа.exe
Size

756KB
MD5

7298a7deda422520d5cf1d60b58b1efb
SHA1

5716a49dca3a493aec8aa2fe33f13dbd04c2b803
SHA256

45d799de575c920edd8fcabe0d57341599ba53d80d3f20c82f1f6ba0a190f97f
SHA512

f5b7831e0057d20f93e18a1c2999a37835bcb27912214ca653536e1068ace9d5387c12b4607ee4a9ed1ec9fb778237334f0447ee8acdd2ba2dbe528cfdcef73b
SSDEEP

12288:OIgWET/mr9K+22BEEzFatn4904fne9OUuqlde7tUlLCQPPjBbfg4NGP+uXaV9ohu:gWtb3BEG904feduYlL33jJ3uDhZj8C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2004	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	счет для получения платежа.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	счет для получения платежа.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2724	2004	счет для получения платежа.exe	28
PID 2004 wrote to memory of 2724	2004	счет для получения платежа.exe	28
PID 2004 wrote to memory of 2724	2004	счет для получения платежа.exe	28
PID 2004 wrote to memory of 2724	2004	счет для получения платежа.exe	28

C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe
"C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 692
  2⤵
  - Program crash
  PID:2724

memory/2004-0-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/2004-1-0x00000000013D0000-0x0000000001494000-memory.dmp

Filesize
784KB

Download
memory/2004-2-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2004-3-0x0000000000510000-0x0000000000532000-memory.dmp

Filesize
136KB

Download
memory/2004-4-0x0000000000310000-0x000000000031C000-memory.dmp

Filesize
48KB

Download
memory/2004-5-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2004-6-0x0000000005080000-0x0000000005102000-memory.dmp

Filesize
520KB

Download
memory/2004-7-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/2004-8-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download