1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a

Analysis

Target
RV OFFER REF 571 - REF. INQUIRY NP17836.exe
Size 723KB
Sample200720-nd29bc1s4x
SHA256 1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a
MD5 b659d359a6fafaf7954c78199552852e
SHA1 027ce3b08fe9c0c47114d6711fb26551eba96a72
SHA512 6699fc5fa65b322edb6ea59062b36deb2a33e481c608a49503c24d3479d7a1feed07ddcefdd9987e9943b5999125148c9330a1717db4f1e10a7377d4a6ef5689
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	3944	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\RV OFFER REF 571 - REF. INQUIRY NP17836.exe
"C:\Users\Admin\AppData\Local\Temp\RV OFFER REF 571 - REF. INQUIRY NP17836.exe"
1⤵
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 900
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

memory/2108-0-0x00000000042C0000-0x00000000042C1000-memory.dmp

Download

memory/2108-1-0x0000000004700000-0x0000000004701000-memory.dmp

Download

memory/2108-2-0x0000000004B00000-0x0000000004B01000-memory.dmp

Download