d8bc45dfe42dc6266ac8e05d9e00206c3c4997dd2c287bb5ef1d4bb8862b8d02

Analysis

Target
Transfer Form.scr
Size 522KB
Sample200722-4t1rama2b6
SHA256 d8bc45dfe42dc6266ac8e05d9e00206c3c4997dd2c287bb5ef1d4bb8862b8d02
MD5 ced902a2157bec84634596ef1a455d05
SHA1 0f176c5d858e7d889e572f094ed0ebf68a5f9045
SHA512 f9fdc1efb96145e0e9468c6313c69deac37f3dad435fb74bd3f38a127c2c6c7fd14ccf103f0958d95d28b60160b6bb29cd0fb42a8928b02e286337da923675e7
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	1616	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr
"C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr" /S
1⤵
PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892

memory/2892-0-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/2892-1-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Download