fb21fea4253258e56da254f5f1009be32ca3b49f2c8dbf617188e9f0afe127d3

Analysis

Target
SHIPPING DOCUMENTS.exe
Size 404KB
Sample200624-g2vpe3wppa
SHA256 fb21fea4253258e56da254f5f1009be32ca3b49f2c8dbf617188e9f0afe127d3
MD5 3b193396b18fbfcca64fb718a1e94d61
SHA1 1166aa4ce5675071a138918490d5797ac7829c6c
SHA512 5b0f4502fbd06a11540a0845df5de971eda9a47a80d4d44ddd7651e86a26cdbc6043955b1d46090883a1941b9195e549cdcaa68c027a36588eeff8ef746d1789
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8	3008	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS.exe"
1⤵
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 1140
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:8

memory/8-0-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/8-1-0x00000000053C0000-0x00000000053C1000-memory.dmp

Download