45d2b537d6257e582b1a4acc8d914abb211a4c75241740c21679f10e2c8c8d76

Analysis

Target
RFQ_072-756.exe
Size 556KB
Sample200721-9j7pledjes
SHA256 45d2b537d6257e582b1a4acc8d914abb211a4c75241740c21679f10e2c8c8d76
MD5 d4a7b13705b75747cf70958fbf189804
SHA1 e7443f16241593040cd178c07bf9cfdc51e13cb3
SHA512 2d66966c2b7716daef7ea2c9e24096cdbcfb85a7c9f7c1b009b0c89bf3b490a7a97a1e369fe27f629d2b66d35a684fd78db11513984a7fe781ad378a0faf0772
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3888	3832	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\RFQ_072-756.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_072-756.exe"
1⤵
PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 1196
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3888

memory/3888-0-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/3888-1-0x0000000005970000-0x0000000005971000-memory.dmp

Download