74b7a02e49c6319963fefe23a1736cf16bfd63ebb672a541d97c95601f840a49

Analysis

Target
QUOTE 008331.pdf.exe
Size 487KB
Sample200731-c69ctjx34e
SHA256 74b7a02e49c6319963fefe23a1736cf16bfd63ebb672a541d97c95601f840a49
MD5 70655c720bc1938bf9bca6bd143e5fbe
SHA1 82d1f8b9f0490b8272ace3240c024c9ff592c4dd
SHA512 a684ea191d8560576ab33949dfcc302188ee504b761c89b646e786f147e9e2a7ca1808c1e0ffd7c5575ecab0962df6d2cd7e22d0736ec0b9aebed28e73d484a3
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1940	2920	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\QUOTE 008331.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE 008331.pdf.exe"
1⤵
PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1172
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940

memory/1940-0-0x00000000044F0000-0x00000000044F1000-memory.dmp

Download

memory/1940-1-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download