c8e97577eeb35634eecb4cc3b4917d2f851691bf318ed79b298eb3830c641a01

Analysis

Target
PO. RFQ-FSTG-20200017.pdf.exe
Size 887KB
Sample200718-7c944f1cf2
SHA256 c8e97577eeb35634eecb4cc3b4917d2f851691bf318ed79b298eb3830c641a01
MD5 c952993c6db15d8b032a17afbae99694
SHA1 6511607ac99965f5b2395c3af8d6219eab59f856
SHA512 f723892f8022748f8e6961bb40918c28aff56a93aee1b302a7ca54b6eeef4663535373271e12f422fd9af2808933947fe55abe9da9d626b43b3b4ad733455780
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3800	3588	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\PO. RFQ-FSTG-20200017.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO. RFQ-FSTG-20200017.pdf.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1156
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800

memory/3800-0-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/3800-1-0x0000000005720000-0x0000000005721000-memory.dmp

Download