15f292d3edec1c064cbde19f7d0df8e891cfd3d61a3982f952b3d3d1d39d2755

Analysis

Target
Quotation.exe
Size 487KB
Sample200624-9zbr5lapwe
SHA256 15f292d3edec1c064cbde19f7d0df8e891cfd3d61a3982f952b3d3d1d39d2755
MD5 11eeca4abfe5a57bb459ce5603ac83ac
SHA1 677b4ac15b78ffd701de55e95d810fd71f4d5e6f
SHA512 ae73a6503089081dc180cb281a2c2cfc29ef25d54152d30513fd968a4f30ab4f88ccdfc7fb2f68fb6b14aac3f21c2225c626b013aa9c20a30ae4f8f5f68f15f8
MD5 SHA1 SHA512

Score

3^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1412	616	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1412	616	Quotation.exe	24
PID 616 wrote to memory of 1412	616	Quotation.exe	24
PID 616 wrote to memory of 1412	616	Quotation.exe	24
PID 616 wrote to memory of 1412	616	Quotation.exe	24

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 520
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1412

memory/1412-1-0x0000000001E70000-0x0000000001E81000-memory.dmp

Download

memory/1412-2-0x00000000025F0000-0x0000000002601000-memory.dmp

Download