7edb6382eaeded52c1341cec1508c797a7d7146d19e508c9713a4266ac823c8a

Analysis

Target
PI-hd748838499487.exe
Size 835KB
Sample200708-gr2y9qlbf6
SHA256 7edb6382eaeded52c1341cec1508c797a7d7146d19e508c9713a4266ac823c8a
MD5 4116c117925d4d862095c6fcd0fd8b87
SHA1 24203232c4f7bb7d522d8413d29c25bfa152a87e
SHA512 47cefac7f9d3c813dda15ef1a19f36e1e0a09f6dd23bf37d158a8a49a491d75d05627b936eddb17637220285481b25b64b544e67f556e233131a92381b45fe0b
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3780	2920	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\PI-hd748838499487.exe
"C:\Users\Admin\AppData\Local\Temp\PI-hd748838499487.exe"
1⤵
PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1152
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3780

memory/3780-0-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/3780-1-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download