400613ea1e4f8a22b1f5ed70e9baca60448af46cfbd70ca6f5ec6b74af5e9fe0

Analysis

Target
Shipment address.exe
Size 941KB
Sample201019-m9bb4whddn
SHA256 400613ea1e4f8a22b1f5ed70e9baca60448af46cfbd70ca6f5ec6b74af5e9fe0
MD5 19739b65cebd4d6b17c8775b1973329a
SHA1 ded2565147d3715353ee71453430460270bfd118
SHA512 3a6ae8c9725c72fb5d6bb1fd8451feea9e4fdeadce2ba6a1a0212e9053fa2c97a5d8ab3a2f9c37021c7ed49dd456163eef112cdb35c081d4a69e33e09a669e02
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1584	1412	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1584	1412	Shipment address.exe	28
PID 1412 wrote to memory of 1584	1412	Shipment address.exe	28
PID 1412 wrote to memory of 1584	1412	Shipment address.exe	28
PID 1412 wrote to memory of 1584	1412	Shipment address.exe	28

C:\Users\Admin\AppData\Local\Temp\Shipment address.exe
"C:\Users\Admin\AppData\Local\Temp\Shipment address.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 600
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584

memory/1412-0-0x0000000074B10000-0x00000000751FE000-memory.dmp

Download

memory/1412-1-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/1584-4-0x0000000002080000-0x0000000002091000-memory.dmp

Download

memory/1584-5-0x00000000025C0000-0x00000000025D1000-memory.dmp

Download