540a1ab8a63b1b07ea3d80939868a94dafb79f6e2fc37a8a2cc22ded21c60deb

Analysis

Target
SecuriteInfo.com.Fareit-FXHF106F3AAB0B4.23403.exe
Size 1.5MB
Sample200717-bcvj3d9k86
SHA256 540a1ab8a63b1b07ea3d80939868a94dafb79f6e2fc37a8a2cc22ded21c60deb
MD5 f106f3aab0b43316cc513c5ab20ff961
SHA1 5741c302a5d4292632b95c68b00856945e30293b
SHA512 3f877666b9314f4215ab244380f7b188d65ae75f97900c36546b70c03e6668a4bd1228aaba77946a009d682a72bd8bfb3b6dd19fd8647bb468c0d3138e9eec1e
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2536	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Fareit-FXHF106F3AAB0B4.23403.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Fareit-FXHF106F3AAB0B4.23403.exe"
1⤵
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 1156
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2784

memory/2784-0-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/2784-1-0x0000000005170000-0x0000000005171000-memory.dmp

Download