452413e4c1ae53679f676ea7e97a7f98697ee833896c6119bc6d8bf15cf06fba

Analysis

Target
SOA - 13-07-2020.exe
Size 702KB
Sample200713-3g7d5a7rn2
SHA256 452413e4c1ae53679f676ea7e97a7f98697ee833896c6119bc6d8bf15cf06fba
MD5 7afce2776cafbc31ae2ea92059d9a78c
SHA1 1afcaa6c26a2e8ea5349c92717c9b92131eef371
SHA512 343ab30e8486eef5ab53390ee44f67260ef3b0a87baba7ee30d7b5671514a020b0d9e58f7d96835e297e4ed5cbc4ee25b7d9c0b5704f241ddbbc6e5c4de456ef
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3776	2920	WerFault.exe	66

C:\Users\Admin\AppData\Local\Temp\SOA - 13-07-2020.exe
"C:\Users\Admin\AppData\Local\Temp\SOA - 13-07-2020.exe"
1⤵
PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1140
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:3776

memory/3776-0-0x0000000004240000-0x0000000004241000-memory.dmp

Download

memory/3776-1-0x0000000004880000-0x0000000004881000-memory.dmp

Download