fad6f1e59c3d79075062761a1003d8877f258b30999d5bfef6512c9a09f85a35

Analysis

Target
SecuriteInfo.com.Trojan.PackedNET.380.1927.25730.exe
Size 193KB
Sample200710-pvdd8cjp4x
SHA256 fad6f1e59c3d79075062761a1003d8877f258b30999d5bfef6512c9a09f85a35
MD5 c2257678b2fa6523210ba60d4fbfcdda
SHA1 1417d42f550ee3ad0d802a298a14712011cfa8fa
SHA512 0ca3b162fba84d31afcf700ecbef776dcb9059e1171c9301cef2691d4597870ec9ff4fbc2b041c04e4179d2479f28504cd26d4540a2b3d5026cdc34d0341f2bc
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3784	3588	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.380.1927.25730.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.380.1927.25730.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 912
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3784

memory/3784-0-0x00000000043D0000-0x00000000043D1000-memory.dmp

Download

memory/3784-2-0x0000000004910000-0x0000000004911000-memory.dmp

Download