3b91f298cfdb9541f0d548a38576e37012c645926ab3383d21677087c107b52f

Analysis

Target
New Iquiry.exe
Size 552KB
Sample200716-llvfswgdvs
SHA256 3b91f298cfdb9541f0d548a38576e37012c645926ab3383d21677087c107b52f
MD5 1393fb7819f6038dba4822d3fa0b34da
SHA1 4b7fbce0e12551ba62702fd1a20041caa9fc8575
SHA512 a72801f079a939d09f14b8e761c44c35e2ab8a91fc40caeb32e3200382b08f3a8ee148989ba9fd05fb05c5c77c5874fa8402524be35fa71a8b7427232abdf90c
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	1500	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\New Iquiry.exe
"C:\Users\Admin\AppData\Local\Temp\New Iquiry.exe"
1⤵
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 924
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792

memory/2792-0-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/2792-1-0x0000000004F20000-0x0000000004F21000-memory.dmp

Download