c964296558dc6cf1a3e305f48af7ea8b6736ef61f01425dbfabc6fd32cd4eb87

Analysis

Target
Facturas Pagadas al Vencimiento.exe
Size 409KB
Sample200624-emfpy1w572
SHA256 c964296558dc6cf1a3e305f48af7ea8b6736ef61f01425dbfabc6fd32cd4eb87
MD5 58a3acfa7c3eec6903a1a2080587968f
SHA1 29b3cc1631a5add3a5e0c26a8e9675951dd6e774
SHA512 3371f3c10abc26c325311874923203a1f1abeae5184e01bc71dc0d4786e17b8071e3293d1c5c143a1bb0999fbac479b67e0463c9e6119c803faaf14dcbe11875
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	3692	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe
"C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe"
1⤵
PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 900
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2484

memory/2484-0-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/2484-1-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download