e1600d5f0faed67689243cf28c68e6d34edeaa62693da3ca7028d252ef3207bb

Analysis

Target
RFQ#(10098764).pdf.exe
Size 439KB
Sample200723-sebnl8e6yn
SHA256 e1600d5f0faed67689243cf28c68e6d34edeaa62693da3ca7028d252ef3207bb
MD5 3ad879c6f4f99d6d65d51b1dbce8d5c7
SHA1 bcd820ca4318964510392e5ce3e47b0be7120c2f
SHA512 c5eb4808d5d54e5a9285fa256ae42876958df5980b0d135e03bb0c665275b5f4ff2578281d40cdb5c634c42aed8efc0c5ecf0b8ae4ed06ed5779a92d37248630
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	1928	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\RFQ#(10098764).pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ#(10098764).pdf.exe"
1⤵
PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 896
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064

memory/3064-0-0x0000000004500000-0x0000000004501000-memory.dmp

Download

memory/3064-1-0x0000000004B40000-0x0000000004B41000-memory.dmp

Download