23f73a5c76d3f569e043322817d14f2618301b8ed17db3c52d26813b1a27b298

Analysis

Target
REQUEST FOR QUOTATION.exe
Size 524KB
Sample200716-th9xy74rqa
SHA256 23f73a5c76d3f569e043322817d14f2618301b8ed17db3c52d26813b1a27b298
MD5 2d02fc0bb28b135bd28dcd4b66447e3e
SHA1 eb509573abe7488ba23a02cb7326fa2f4e3d8c27
SHA512 a8ac57edce70b775823a2874439f89006ddf9d53de1cc901aad32ccc985d2d8f09f782bf88231cdc69c9e1df0136046012b3bbc4d8bc4a7e10a15626d356a26b
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	3028	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"
1⤵
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860

memory/3860-0-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/3860-2-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download