9d7e42c747de8d1f950c5fb27e4bee452d41140969f7a3af1da9e20e7fde6613

Analysis

Target
sheet Order.exe
Size 324KB
Sample200713-4kzxzynp76
SHA256 9d7e42c747de8d1f950c5fb27e4bee452d41140969f7a3af1da9e20e7fde6613
MD5 be0e5ec452c3521a9c335564f386110f
SHA1 d7a37c4821ec8a252b84354d98ca0437d94c3055
SHA512 80bc1049ce5b41d0b6e9a5c242444c78cafdd70c13934956ae67daba70871b1b8117a13d77c4633b95f883a4a123a974ee13edbb2088bbe7bbc204fce20afc79
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	1008	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\sheet Order.exe
"C:\Users\Admin\AppData\Local\Temp\sheet Order.exe"
1⤵
PID:1008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 1136
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164

memory/2164-0-0x0000000004650000-0x0000000004651000-memory.dmp

Download

memory/2164-1-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Download