7dcf74ef421a57fac957c783af2b28e5fe6b13aff4e709edd1fec8f4c3ff7e63

Analysis

Target
RFQ07132020_PDF.exe
Size 1.1MB
Sample200713-te2drd4m9a
SHA256 7dcf74ef421a57fac957c783af2b28e5fe6b13aff4e709edd1fec8f4c3ff7e63
MD5 a654fd5fcc10e1307514f803a4acb037
SHA1 68476e4e1fcce7ea06d6874df20536c1dfa6b5b3
SHA512 e47c20d8a1498a2fdb7e13180ad81b4e4096971a0ecb715ac72a1766a5171b4338502675f62bc191249e3227924d19b5a9ed8d3f306a71c67e128f32102e5ba1
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	1820	WerFault.exe	67

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\RFQ07132020_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ07132020_PDF.exe"
1⤵
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 908
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2556

memory/2556-0-0x0000000004640000-0x0000000004641000-memory.dmp

Download

memory/2556-1-0x0000000004640000-0x0000000004641000-memory.dmp

Download

memory/2556-3-0x0000000004640000-0x0000000004641000-memory.dmp

Download

memory/2556-6-0x00000000048C0000-0x00000000048C1000-memory.dmp

Download