409f59c1740922e313e2844cf57dc14941f747be52e7d69a1ec2277e2700f88a

Analysis

Target
DOC 98450005996 SCANPDF.exe
Size 793KB
Sample200729-7yj6pjlsfa
SHA256 409f59c1740922e313e2844cf57dc14941f747be52e7d69a1ec2277e2700f88a
MD5 676fce494b5e4b908a19481ca6af7fcf
SHA1 af8f147ce7cabc525009d20df6e8ac73bcbe963b
SHA512 520d7ba55d61fe602fef4dd1aac952843322f45597649f03799d74ceffa1e573ab03f7376723142dbfe86e8e35a83be3964d16bf3ca51df89578436847d62736
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3852	2728	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\DOC 98450005996 SCANPDF.exe
"C:\Users\Admin\AppData\Local\Temp\DOC 98450005996 SCANPDF.exe"
1⤵
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 1124
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3852

memory/3852-0-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/3852-1-0x0000000005160000-0x0000000005161000-memory.dmp

Download

memory/3852-2-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download