b02c63fa6f891643db5b6e806529c66f514d66cfba5b49030eebe2a572edec54

Analysis

Target
RFQ-OM-3994 - Closing Date 30.06.2020 - MEPF-PO-2020-060.exe
Size 493KB
Sample200625-yxpg1tsrxe
SHA256 b02c63fa6f891643db5b6e806529c66f514d66cfba5b49030eebe2a572edec54
MD5 27b06854a9e51536995a3e423b853c1d
SHA1 1a91eb1dc1cc998fa6672cc5e48c21794f977c2e
SHA512 5498afe27af9622cb5a05b627f1292cf5b2669bab088de370d71c5442d3ecc8a94e24b8b0ef6a0cba2860196b50b4bce8185d57efa2baaa6261f0df00fbe6f94
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3840	2460	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\RFQ-OM-3994 - Closing Date 30.06.2020 - MEPF-PO-2020-060.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-OM-3994 - Closing Date 30.06.2020 - MEPF-PO-2020-060.exe"
1⤵
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1152
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3840

memory/3840-0-0x0000000004470000-0x0000000004471000-memory.dmp

Download

memory/3840-1-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download