9362e0d04c5ae6249cf30df1fa0e969425ef058bfd39d8742014a035cf213541

Analysis

Target
REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe
Size 303KB
Sample200624-bsm8fzc86a
SHA256 9362e0d04c5ae6249cf30df1fa0e969425ef058bfd39d8742014a035cf213541
MD5 0a182475466bc3051fad4fadcb4f2243
SHA1 cd3ae1867c0d37915fa9fa264d73f3fef698fb25
SHA512 a2d223a166b79151b77a87f2c8d8b4cef45f04210f57a387bdfe252fd8944296269c946fc5cfdf3a6e66b5bd52d82a7fa6cb9a83b4b5d2a61b372af9da37d24b
MD5 SHA1 SHA512

Score

3^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	416	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe
"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATIONS AND SPECIFICATIONS.pif.exe"
1⤵
PID:416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 900
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2996

memory/2996-0-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/2996-1-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download