608c72464a4e7119e194ce6aebd289fcbfd82fc4111fe67514acb1fccb1ff574

Analysis

Target
Amann (Vietnam) Co., Ltd - Purchase Order.exe
Size 486KB
Sample200703-bt8ntpbvke
SHA256 608c72464a4e7119e194ce6aebd289fcbfd82fc4111fe67514acb1fccb1ff574
MD5 1a5b7c70a1f618180f7981d891602877
SHA1 0ea809ca08077c14b1d98693ede077da8de84b54
SHA512 62d56290385a6fb5e7f717e4448e66ee389aabed7d4b61646d2f435af3ebdee6dd50512bd01ae07612f6ec4d5044b5f450e3611ec429720be5312958501f0373
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1008	2416	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Amann (Vietnam) Co., Ltd - Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Amann (Vietnam) Co., Ltd - Purchase Order.exe"
1⤵
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1152
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1008

memory/1008-0-0x00000000050B0000-0x00000000050B1000-memory.dmp

Download

memory/1008-1-0x00000000057F0000-0x00000000057F1000-memory.dmp

Download