9d988ed519f6e3f6c1e9baec5fca64bbc07fbcbb09f8dd6a02d4b756d1f4ef6e

Analysis

Target
5X40ft Containers.exe
Size 438KB
Sample200624-hmvnbvmhes
SHA256 9d988ed519f6e3f6c1e9baec5fca64bbc07fbcbb09f8dd6a02d4b756d1f4ef6e
MD5 1af135fb8f6ae323f00e79fdffa28614
SHA1 3fda3bab855977ec61f8c8a9fc8b2afebfbbfe5f
SHA512 4e8c6fc8aeba956d3b80717a56490fbfe311927b6d0ab3d37269fa42f7406aea1f9ecd014f4d8a0188bf0c9e4d1b22d64d3ed3280190ade061bb70ee55bebf92
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	1868	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\5X40ft Containers.exe
"C:\Users\Admin\AppData\Local\Temp\5X40ft Containers.exe"
1⤵
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 900
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732

memory/3732-0-0x00000000042A0000-0x00000000042A1000-memory.dmp

Download

memory/3732-1-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download