fd108b640511e040ff81be0ea54bb8bdfdb12aff54def52ac147c3fa112a143e

Analysis

Target
MV BAO HONG 8.exe
Size 721KB
Sample200721-g441kncd9s
SHA256 fd108b640511e040ff81be0ea54bb8bdfdb12aff54def52ac147c3fa112a143e
MD5 bfd2145018ef78abe6735ae1e4cddaf3
SHA1 ff555d3a1968a706add19a6fbb1012011923a4b0
SHA512 31ba2aa7fe23fe4a5435f521d4258976bdfd45eb4462bee7bd7ee2b0ad9889e9eaf67696bfe93124e19f703574c1e5030b27b11d0cb7593c077257ee0de34740
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	2984	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\MV BAO HONG 8.exe
"C:\Users\Admin\AppData\Local\Temp\MV BAO HONG 8.exe"
1⤵
PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 1204
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4048

memory/4048-0-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/4048-1-0x0000000005730000-0x0000000005731000-memory.dmp

Download