54d05b40cd778ff8328576a776c5f28c5bf6db2c15bd6ccb4dce17a27336d55d

Analysis

Target
ALTAYER STOCKS - PO.29IHNTHOUI8.exe
Size 611KB
Sample200624-q76pc3rkye
SHA256 54d05b40cd778ff8328576a776c5f28c5bf6db2c15bd6ccb4dce17a27336d55d
MD5 5820f368d7b26d13b98688fc0e555b81
SHA1 01f17dca2c9305568bcdb109cebadd70b280508d
SHA512 9407ddcaab485d175e5c10e11f81abbeb1358d7c2d950e79f59dd67b6a901e784eb5592c4a97a487d23a5b873cc9b8af8624a5301a7f8ff29f27964b2d684f63
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3828	4092	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\ALTAYER STOCKS - PO.29IHNTHOUI8.exe
"C:\Users\Admin\AppData\Local\Temp\ALTAYER STOCKS - PO.29IHNTHOUI8.exe"
1⤵
PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 1104
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3828

memory/3828-0-0x0000000004360000-0x0000000004361000-memory.dmp

Download

memory/3828-1-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download