150d964fbfa64a31d6d9846500d2353e2aab67c7664cd222244c8e97c8e24b95

Analysis

Target
URGENT QUOTATION.exe
Size 549KB
Sample200728-qkm3cxbmxe
SHA256 150d964fbfa64a31d6d9846500d2353e2aab67c7664cd222244c8e97c8e24b95
MD5 203695345c45125e54608c6aed247b88
SHA1 8bb6d8101db17c8337b20797ac18d2c8c0fc56a9
SHA512 5043c3b6c48c050c71a723ed1bd3a8a0951fa97167afdb7760649f783dee99f90aa925de260a1d93d9f214d8c98060d2b8c1ce7b1abbbf54a720337e0880443d
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3500	3060	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\URGENT QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\URGENT QUOTATION.exe"
1⤵
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1176
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3500

memory/3500-0-0x00000000041E0000-0x00000000041E1000-memory.dmp

Download

memory/3500-1-0x0000000004920000-0x0000000004921000-memory.dmp

Download