50c55bbf1276483fe2af586e9caeab97087be04a0bc6afd90c9928d82ecde081

Analysis

Target
order details.xls.qa.exe
Size 921KB
Sample201105-pchdza92be
SHA256 50c55bbf1276483fe2af586e9caeab97087be04a0bc6afd90c9928d82ecde081
MD5 aad4603d17296a4586b6f378d4ad3242
SHA1 958e6abe734e62e8221105a1151b585deecf71bd
SHA512 ab0c3e410cb0f15541069dd64d25d9619bc3e3245c219da8b89f58b19055c3d7ba1e1978b5f00fd32b9475292575f7d71c1e6e0033b8030d5c38edd21f92ee01
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	288	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 2012	288	order details.xls.qa.exe	26
PID 288 wrote to memory of 2012	288	order details.xls.qa.exe	26
PID 288 wrote to memory of 2012	288	order details.xls.qa.exe	26
PID 288 wrote to memory of 2012	288	order details.xls.qa.exe	26

C:\Users\Admin\AppData\Local\Temp\order details.xls.qa.exe
"C:\Users\Admin\AppData\Local\Temp\order details.xls.qa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 600
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012

memory/2012-1-0x0000000001FB0000-0x0000000001FC1000-memory.dmp

Download

memory/2012-2-0x00000000027F0000-0x0000000002801000-memory.dmp

Download