3c15d1bb32d82a136a76d6e8867506dc2cc12cc183ed5a5c79335cb569e7d52c

Analysis

Target
Specs INQUIRY.exe
Size 386KB
Sample200722-pn5fpbe35s
SHA256 3c15d1bb32d82a136a76d6e8867506dc2cc12cc183ed5a5c79335cb569e7d52c
MD5 84c148d04013e64d21ebac8e8b1fe121
SHA1 1831d5dd11f54a9d46428992d6e1625d24565302
SHA512 4744858741a8c4c7768d954254bc52368110b716a477d83b9fbea80201a8a2aee875f0ccedd4b751bd8ef2d6951273f1c1ed0c89acc0c679a1765871bc59c5f9
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	3588	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious behavior: EnumeratesProcesses 13 IoCs

C:\Users\Admin\AppData\Local\Temp\Specs INQUIRY.exe
"C:\Users\Admin\AppData\Local\Temp\Specs INQUIRY.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 904
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3940

memory/3940-0-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/3940-1-0x0000000005180000-0x0000000005181000-memory.dmp

Download