f37537ab1a0c2fd830bf2ea03f299ceccf2d1eb5f8c72be80580a680450da4aa

Analysis

Target
[email protected]
Size 719KB
Sample200706-dzgktrnejs
SHA256 f37537ab1a0c2fd830bf2ea03f299ceccf2d1eb5f8c72be80580a680450da4aa
MD5 ea41b309917c1fd7d931e81272af6afa
SHA1 a2b410693a7f156352091200fc2cc7747d1827b6
SHA512 e236cd2f0025226426837550f3419c4f7f4111d122263ea14f48d4c57d8e948c023073b03db5109c4f019d9c1ded46dffb5a3a1de1b4c789a0b9db33e3792e4b
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3604	1628	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 1168
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:3604

memory/3604-0-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/3604-1-0x0000000005890000-0x0000000005891000-memory.dmp

Download