19f43d1f8fd11eccbdb2d9ce05a16983fe394cbd92943bc57943e4bbbb686687

Analysis

Target
dhlShipment Document BL,INV and Packing List Attached.exe
Size 759KB
Sample200804-5tqa8xhtda
SHA256 19f43d1f8fd11eccbdb2d9ce05a16983fe394cbd92943bc57943e4bbbb686687
MD5 cac2ea2a23327bf7cf631ecb376f53d2
SHA1 6e5d088b7964f752c2c0cde04f4e9dc2e1dbae93
SHA512 84b2988d89c2387ea65fdf53f45309f2d3bdea961f6d61536bb4bb609591dd9085020b76d8b8cdc81927f96a73b903c815a4c9a0b5269922c775c1cddf0257c4
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	3732	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\dhlShipment Document BL,INV and Packing List Attached.exe
"C:\Users\Admin\AppData\Local\Temp\dhlShipment Document BL,INV and Packing List Attached.exe"
1⤵
PID:3732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 912
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2672

memory/2672-0-0x00000000047A0000-0x00000000047A1000-memory.dmp

Download

memory/2672-1-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download