bf97ebb29f4d642141db6cbb16fae9bf216fc66a4b8bf6816c684084237c7336

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:23

Target

Bank Failed Payment Report.exe
Size

753KB
MD5

4a7f3f8374faba6572e3ab3346324b4d
SHA1

5b6bd9bcabb0b34cea778bffcff1848ce73a8e60
SHA256

bf97ebb29f4d642141db6cbb16fae9bf216fc66a4b8bf6816c684084237c7336
SHA512

f5e265bff50e18d43f63839629ace975a76b12c0b5f5a83071cb7f03c6fd29bdc1454d218a176c8a985a43f384eaedb3390a398e87fd5cc340e20fbb81611038
SSDEEP

12288:H+gbVydJS4Vzu82ae0r+AC0cU18FyxcUnJehpuo+2wd8CbQTCd/SDBovDv5vHSzZ:eW4Sczr+EjcUn8HB+dyHmmBovbAzeu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2060	Bank Failed Payment Report.exe
2060	Bank Failed Payment Report.exe
2060	Bank Failed Payment Report.exe
2060	Bank Failed Payment Report.exe
2060	Bank Failed Payment Report.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	Bank Failed Payment Report.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3028	2060	Bank Failed Payment Report.exe	28
PID 2060 wrote to memory of 3028	2060	Bank Failed Payment Report.exe	28
PID 2060 wrote to memory of 3028	2060	Bank Failed Payment Report.exe	28
PID 2060 wrote to memory of 3028	2060	Bank Failed Payment Report.exe	28
PID 2060 wrote to memory of 2580	2060	Bank Failed Payment Report.exe	29
PID 2060 wrote to memory of 2580	2060	Bank Failed Payment Report.exe	29
PID 2060 wrote to memory of 2580	2060	Bank Failed Payment Report.exe	29
PID 2060 wrote to memory of 2580	2060	Bank Failed Payment Report.exe	29
PID 2060 wrote to memory of 2632	2060	Bank Failed Payment Report.exe	30
PID 2060 wrote to memory of 2632	2060	Bank Failed Payment Report.exe	30
PID 2060 wrote to memory of 2632	2060	Bank Failed Payment Report.exe	30
PID 2060 wrote to memory of 2632	2060	Bank Failed Payment Report.exe	30
PID 2060 wrote to memory of 2052	2060	Bank Failed Payment Report.exe	31
PID 2060 wrote to memory of 2052	2060	Bank Failed Payment Report.exe	31
PID 2060 wrote to memory of 2052	2060	Bank Failed Payment Report.exe	31
PID 2060 wrote to memory of 2052	2060	Bank Failed Payment Report.exe	31
PID 2060 wrote to memory of 2112	2060	Bank Failed Payment Report.exe	32
PID 2060 wrote to memory of 2112	2060	Bank Failed Payment Report.exe	32
PID 2060 wrote to memory of 2112	2060	Bank Failed Payment Report.exe	32
PID 2060 wrote to memory of 2112	2060	Bank Failed Payment Report.exe	32

C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe"
  2⤵
  PID:3028
- C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe"
  2⤵
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe"
  2⤵
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe"
  2⤵
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe
  "C:\Users\Admin\AppData\Local\Temp\Bank Failed Payment Report.exe"
  2⤵
  PID:2112

memory/2060-0-0x000000007482E000-0x000000007482F000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x0000000000380000-0x000000000043E000-memory.dmp

Filesize
760KB

Download
memory/2060-2-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2060-3-0x0000000000770000-0x0000000000788000-memory.dmp

Filesize
96KB

Download
memory/2060-4-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/2060-5-0x0000000005E60000-0x0000000005EEA000-memory.dmp

Filesize
552KB

Download
memory/2060-6-0x0000000074820000-0x0000000074F0E000-memory.dmp

Filesize
6.9MB

Download