58ab939bd2ec0d5d90a58a3be754b4a5a745fb0263b7f211f5f199bca4b4ba22

Analysis

Target
RFQ LM2936MPX.exe
Size 836KB
Sample200804-c5tktwl9yn
SHA256 58ab939bd2ec0d5d90a58a3be754b4a5a745fb0263b7f211f5f199bca4b4ba22
MD5 1307faf78a3b2cf812c7603072e07975
SHA1 07c5d4a08734c70bca57665570df00f8205f6b98
SHA512 33957e9795ae6de9baf137231147882b697c5e9affeec8c96676408c8bdc686fa4837f58aa652fee9323c50810dead0d6ee28c586aa048edcc611db2903e35d8
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4032	792	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

C:\Users\Admin\AppData\Local\Temp\RFQ LM2936MPX.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ LM2936MPX.exe"
1⤵
PID:792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 908
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4032

memory/4032-0-0x00000000046E0000-0x00000000046E1000-memory.dmp

Download

memory/4032-1-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download