e6f366cac76ffc8b790c6d9b48a13d522c4d5d565da0ef1ed41ff726074755ed

Analysis

Target
cotizacin 345355.PDF.exe
Size 1.2MB
Sample200729-dfvdlgr2bn
SHA256 e6f366cac76ffc8b790c6d9b48a13d522c4d5d565da0ef1ed41ff726074755ed
MD5 326ce69d35d328a83ceeb3ba927ec9dc
SHA1 6effef246359abd61c253057c63a82f5ea41e80a
SHA512 8a067a48e76256c7796b601e6ab335000a330934a5b4b50c2298cfd39ce031ead14fb540b3e317dd183c071971aef408a504f9095281edbbf4857d22fd5759df
MD5 SHA1 SHA512

Score

3^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	WerFault.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	900	WerFault.exe	23

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1288	900	cotizacin 345355.PDF.exe	24
PID 900 wrote to memory of 1288	900	cotizacin 345355.PDF.exe	24
PID 900 wrote to memory of 1288	900	cotizacin 345355.PDF.exe	24
PID 900 wrote to memory of 1288	900	cotizacin 345355.PDF.exe	24

C:\Users\Admin\AppData\Local\Temp\cotizacin 345355.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\cotizacin 345355.PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 624
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Program crash
  PID:1288

memory/1288-1-0x0000000002000000-0x0000000002011000-memory.dmp

Download

memory/1288-4-0x00000000024A0000-0x00000000024B1000-memory.dmp

Download