b35ad0fe6a5d3df3158c26cda0089cded4b956857ea965877fe553bf7e2ac3b8

Analysis

Target
Quote Reference.exe
Size 537KB
Sample200731-rm1nxlsdmj
SHA256 b35ad0fe6a5d3df3158c26cda0089cded4b956857ea965877fe553bf7e2ac3b8
MD5 49bb7f296f0a614f5dfce69519568a0c
SHA1 9aaa30e5a43187c74906c9b19bb02447f894e366
SHA512 a95dbeca11673ce19327bbce054c2957a9663c9b59010e2f70342db9770644b679c3c3d37b058d261c29491a3300d5dc26634196e104a766e5c5a99c286db9ac
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	720	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\Quote Reference.exe
"C:\Users\Admin\AppData\Local\Temp\Quote Reference.exe"
1⤵
PID:720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1172
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924

memory/3924-0-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/3924-1-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/3924-2-0x0000000005190000-0x0000000005191000-memory.dmp

Download