5acfaa45206fa03fc84c524016caa909e43f04e1c78232060439f354cc6e5ff2

Analysis

Target
PRODUCT REQUEST_PDF.exe
Size 882KB
Sample200716-4nbewvwrsn
SHA256 5acfaa45206fa03fc84c524016caa909e43f04e1c78232060439f354cc6e5ff2
MD5 f1cc787ae4aeed618f5d0606a70de512
SHA1 d5ff4fe3e167f1371242b002e650ac90f5b1d244
SHA512 5b3601ea6ec47e741d3ec3a022f4b1c97ed08a9d35741085acc6647ebf05b74f8f5a341930700cc04a5319548ff55727c027acf5cc04d4562f5ec5e89b8a399d
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	3908	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\PRODUCT REQUEST_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PRODUCT REQUEST_PDF.exe"
1⤵
PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 908
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

memory/1752-0-0x00000000049A0000-0x00000000049A1000-memory.dmp

Download

memory/1752-1-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download