4a3cb269a764e5cc5039e72794fcacffdf8fff861e2073f2a8d27352996449dd

Analysis

Target
New orderDoc.exe
Size 525KB
Sample200715-tz62h84tl6
SHA256 4a3cb269a764e5cc5039e72794fcacffdf8fff861e2073f2a8d27352996449dd
MD5 503ba2c6688b990284bd17e71b1996a2
SHA1 cfd89cae8cb02568bd905918eb2ae6d2dc591058
SHA512 d7c16d8a01968db629a6fda6d22cfab092d2db622ad898f08160ecabe4b60b3e8749b6292334faae86ad9411eaa3a1b80e81c2f465330ec8194090d83cb5dc54
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2148	2564	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\New orderDoc.exe
"C:\Users\Admin\AppData\Local\Temp\New orderDoc.exe"
1⤵
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148

memory/2148-0-0x0000000004600000-0x0000000004601000-memory.dmp

Download

memory/2148-1-0x0000000004600000-0x0000000004601000-memory.dmp

Download

memory/2148-3-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Download