0c53c7353fbddd939c3f80a6902e1db4f5d2f7f98d152e9f3f6b00de247b4799

Analysis

Target
DOLOPAR 125 SS - PO #305013755 OUR CUSTOMER EKLER POMPA.exe
Size 488KB
Sample200629-l948eqa6fx
SHA256 0c53c7353fbddd939c3f80a6902e1db4f5d2f7f98d152e9f3f6b00de247b4799
MD5 63987810a7bb6b84934b9d478acc7911
SHA1 b6f973db795227d972bc8b916fef4a8ee5192200
SHA512 c5da9698ccd8c512b5b9c8284dddeb75c3b496b81fa391049b538a5bc2307578a8530afa8432672d433410783184aa61c1528e5506bcfad5402713c3fe254783
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3488	2892	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\DOLOPAR 125 SS - PO #305013755 OUR CUSTOMER EKLER POMPA.exe
"C:\Users\Admin\AppData\Local\Temp\DOLOPAR 125 SS - PO #305013755 OUR CUSTOMER EKLER POMPA.exe"
1⤵
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 1208
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

memory/3488-0-0x0000000004770000-0x0000000004771000-memory.dmp

Download

memory/3488-1-0x0000000004770000-0x0000000004771000-memory.dmp

Download

memory/3488-3-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download