f8a0ada1c983c16a3ff6b107c2a04cac970e51ba9bec2514771271af03b7b9fc

Analysis

Target
SHIPMENT DETAILS - AMSGEV2007007.exe
Size 432KB
Sample200722-d88a8w37ka
SHA256 f8a0ada1c983c16a3ff6b107c2a04cac970e51ba9bec2514771271af03b7b9fc
MD5 bd69e795385ba6cb838fc97ef1d97224
SHA1 a4a43a70aab459d6792f3473a4375e309ac20f56
SHA512 894438f62cb2f3c7d839fb580c56aa091f71dc925fb3373b73491bb5e780cd96de69a0a380e646bc123bb8aa94b730bf7f622354f1b5b28e2ef5a0d01df3be44
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	1876	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\SHIPMENT DETAILS - AMSGEV2007007.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPMENT DETAILS - AMSGEV2007007.exe"
1⤵
PID:1876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3936

memory/3936-0-0x0000000004400000-0x0000000004401000-memory.dmp

Download

memory/3936-2-0x0000000004840000-0x0000000004841000-memory.dmp

Download