06247c71c408077a353d59c0c8d830fcb459e291cddf54ba69cc0e876b255e29

Analysis

Target
Packing list No 24001101055.PDF.exe
Size 222KB
Sample200626-x4cdf722lj
SHA256 06247c71c408077a353d59c0c8d830fcb459e291cddf54ba69cc0e876b255e29
MD5 04c820cb57d1f9fa6b354d4c5121d5ac
SHA1 848e30665c30002ad7614610ee9b2ca49f09888c
SHA512 8dd2b20c85e06308ef4e935530c0cbb00bf96120f9c9e824ca5e04d7758b2ac93720db7014267693c155035bfd4f63441b451fe9454ae4540f1cc19b89fb23cf
MD5 SHA1 SHA512

Score

3^/10

Suspicious behavior: EnumeratesProcesses 14 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3872	2176	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Packing list No 24001101055.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Packing list No 24001101055.PDF.exe"
1⤵
PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 1100
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3872

memory/3872-0-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/3872-1-0x0000000005200000-0x0000000005201000-memory.dmp

Download