79a5a1012a618aa8aeb77bc2742c11120634b0c5ad7bacdf37ee79aff484a6e4

Analysis

Target
QUOTE 002242020.exe
Size 443KB
Sample200624-eh3ffxg2fx
SHA256 79a5a1012a618aa8aeb77bc2742c11120634b0c5ad7bacdf37ee79aff484a6e4
MD5 d7ad39b060b5353c18aca84d326c55e0
SHA1 724ababbaca7fc5b87fc57fcfa9261a06cc4bb54
SHA512 1396a48ba6d1e715fc699b366d38e6e5a356c6bbd9ceca1779f245594848baca8f7b6f25304509b1ea8614ff9c09d5b06af16b526845bceaeb741b22600cc947
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3596	3896	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\QUOTE 002242020.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE 002242020.exe"
1⤵
PID:3896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 900
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596

memory/3596-0-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/3596-1-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/3596-3-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download