cdc3ec36fc39d013df0568b47e34265acb3da05cc313685edda8c0609ba7d325

Analysis

Target
riveduto elenco documenti cd 2.exe
Size 809KB
Sample200624-atz219assx
SHA256 cdc3ec36fc39d013df0568b47e34265acb3da05cc313685edda8c0609ba7d325
MD5 0f0a6dfd0e8d01e19e759ded54704696
SHA1 d0686f19f043c2b2698ec3f54428abcd1dd3d504
SHA512 58514348ac4b1e2aa37c41267082cc91c9ec333e6e2d80d66a1487b91a9016b00865d859aa051f6e75f9fd086184c916febe142ae9bf911ee9d92fb8dbd85f6f
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3868	3024	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\riveduto elenco documenti cd 2.exe
"C:\Users\Admin\AppData\Local\Temp\riveduto elenco documenti cd 2.exe"
1⤵
PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 936
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3868

memory/3868-0-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Download

memory/3868-1-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Download

memory/3868-3-0x0000000005360000-0x0000000005361000-memory.dmp

Download