9aa09beb9797b5ae4b2f80937442a013a32e78cfa8b59838cf364a53d65f71bc

Analysis

Target
SOA- Feb2020 to Jun2020.exe
Size 324KB
Sample200713-ab8wdmshf6
SHA256 9aa09beb9797b5ae4b2f80937442a013a32e78cfa8b59838cf364a53d65f71bc
MD5 c77edf13eafc541ba8bfdfebf7e5aa9b
SHA1 4ceb14f6732f5f6a530623941e83ae1a49379cd6
SHA512 ca6d3ab46bee1b43e829f0257921baf61681092644a908bab1840ce64de18a6343fce600611794dc802c448ef6365775f76a69a50050c50d2d0809762d3dcdcd
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	3060	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\SOA- Feb2020 to Jun2020.exe
"C:\Users\Admin\AppData\Local\Temp\SOA- Feb2020 to Jun2020.exe"
1⤵
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1140
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1840

memory/1840-0-0x0000000004C70000-0x0000000004C71000-memory.dmp

Download

memory/1840-1-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download