fe8b7dfe8bc6cf9d0bf54942b5bdb15a1f24cc9fd7b2f680413ec97885ec1118

Analysis

Target
BL & SHIPPING DOCUMENT PPTX.EXE
Size 477KB
Sample200624-5tlp19mht2
SHA256 fe8b7dfe8bc6cf9d0bf54942b5bdb15a1f24cc9fd7b2f680413ec97885ec1118
MD5 c243cc720d1eda1c6a13baee37b4c1d1
SHA1 946a34575eb88801da37b1e6c46a9b6afc694182
SHA512 f72fdbcb27fa02127b61d80ee7e6556b37090bf15b1d14538ce4ab5dbc452f3d7585e0e1642a7875b17a1efb949e9d21e05829f62776fe77d0a42e568e1dfb67
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3844	3676	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\BL & SHIPPING DOCUMENT PPTX.EXE
"C:\Users\Admin\AppData\Local\Temp\BL & SHIPPING DOCUMENT PPTX.EXE"
1⤵
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1168
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844

memory/3844-0-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/3844-1-0x0000000005740000-0x0000000005741000-memory.dmp

Download