082e166994f21973b69b5a604aa7c8172b2c8457b35c8dac62712485962d62cb

Analysis

Target
PEMBAYARAN COPY TT_PDF.exe
Size 941KB
Sample200715-bspg9fsbzx
SHA256 082e166994f21973b69b5a604aa7c8172b2c8457b35c8dac62712485962d62cb
MD5 22522f8628191a783ac603357325b1f9
SHA1 359fd37e7f54e910bdcd1a969d802a866378d640
SHA512 6646a2972652ce6caf1fe7f171b7d5afa9e27932a7f3763b25cd236c9cc018b0be062d3e09df7c2e704f2845b4f18e9ba272d0767cd6e70ac71b54702edc55fb
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	2564	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\PEMBAYARAN COPY TT_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PEMBAYARAN COPY TT_PDF.exe"
1⤵
PID:2564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 936
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

memory/2164-0-0x0000000004540000-0x0000000004541000-memory.dmp

Download

memory/2164-1-0x0000000004540000-0x0000000004541000-memory.dmp

Download

memory/2164-3-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download