82bdf1c9eeecb62113d9b063bcf848c14e4cecf21950b129fefeb40d6ec95a70

Analysis

Target
GIORDANO ORIGINAL S PTED LTD_xls.exe
Size 447KB
Sample200624-bndkmabgl2
SHA256 82bdf1c9eeecb62113d9b063bcf848c14e4cecf21950b129fefeb40d6ec95a70
MD5 1cc5fe611d76af3f15c45d40665eb41b
SHA1 316dd510d425276c2a23cc38602401157b190c0d
SHA512 c0b6d3e7480593dae98b8b61c370e0f6000cc92b9a0892909d413c2bbe951b40507903633a9646bd1d5b0003328195f1a25a69ccb80af493ebd4fb328c25f9ab
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3932	3068	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\GIORDANO ORIGINAL S PTED LTD_xls.exe
"C:\Users\Admin\AppData\Local\Temp\GIORDANO ORIGINAL S PTED LTD_xls.exe"
1⤵
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 1104
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3932

memory/3932-0-0x0000000004440000-0x0000000004441000-memory.dmp

Download

memory/3932-1-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download