415ceff1ef1fa3bfc448613f3f6cc2435051f49ed8961b1cab030d75ee8bd65f

Analysis

Target
sheet#4407465.email.exe
Size 450KB
Sample200724-eqecawfjws
SHA256 415ceff1ef1fa3bfc448613f3f6cc2435051f49ed8961b1cab030d75ee8bd65f
MD5 b68cf2131511dcebc3b6d73c977c4fef
SHA1 92aa85e866df8d9a131be6631e565324f77ee99d
SHA512 b57464af672451fe36b03e6a53c99ddb0f6cfd77bae1b875934ff1f1782c9b3e02a28da75253ddfc1caf72aa71c0fe9b9dfb5424f717590a6d49428e0fd8cc7b
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3668	60	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\sheet#4407465.email.exe
"C:\Users\Admin\AppData\Local\Temp\sheet#4407465.email.exe"
1⤵
PID:60
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 896
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3668

memory/3668-0-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Download

memory/3668-2-0x00000000051F0000-0x00000000051F1000-memory.dmp

Download