ef56c1816b203c94de799dfbc607f74fc7ef4c172322b09c6f2f10abecc3905f

Analysis

Target
Original Shipping Documents_______xlsx.exe
Size 29KB
Sample220519-tym1tscdek
SHA256 ef56c1816b203c94de799dfbc607f74fc7ef4c172322b09c6f2f10abecc3905f
MD5 73ae6ce89e4f4d3d52f104494e92fb4c
SHA1 1d015b5e2463f37f051dfe695dfe689aab65c550
SHA512 fd278653e708b16f5612d43b2355c9c00407a3a310454fe3bb586a55a57c8529c18ddbdb616194f6896de5b5d6a563b8a08e4ae0b0d3c2e21cad5611783903db
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1964	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	Original Shipping Documents_______xlsx.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1984	1964	Original Shipping Documents_______xlsx.exe	27
PID 1964 wrote to memory of 1984	1964	Original Shipping Documents_______xlsx.exe	27
PID 1964 wrote to memory of 1984	1964	Original Shipping Documents_______xlsx.exe	27
PID 1964 wrote to memory of 1984	1964	Original Shipping Documents_______xlsx.exe	27

C:\Users\Admin\AppData\Local\Temp\Original Shipping Documents_______xlsx.exe
"C:\Users\Admin\AppData\Local\Temp\Original Shipping Documents_______xlsx.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1124
  2⤵
  - Program crash
  PID:1984

memory/1964-54-0x0000000001130000-0x000000000113C000-memory.dmp

Download

memory/1964-55-0x0000000000360000-0x0000000000368000-memory.dmp

Download

memory/1964-56-0x0000000075401000-0x0000000075403000-memory.dmp

Download