1971656a7db56f7e14d9f95176b44d0a51deb967bc68dd7b2b8efedb65c76296

Analysis

Target
ORDER_REQUEST09467_PDF.exe
Size 1.1MB
Sample201014-azqp421w8e
SHA256 1971656a7db56f7e14d9f95176b44d0a51deb967bc68dd7b2b8efedb65c76296
MD5 11b513314bf684e6881812ba99f03fa4
SHA1 5e703ca93b1caef4cd32f9ec53a3a2622de41520
SHA512 3ca754c1f4210dd7f5f06ebf6b006d571f65dfcae1fed0de5f79a9b305895885af7006de8845019d52e1867c5b8a1f7ae1d70950dada1004a6847b746e9b3e29
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1576	1304	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1576	1304	ORDER_REQUEST09467_PDF.exe	28
PID 1304 wrote to memory of 1576	1304	ORDER_REQUEST09467_PDF.exe	28
PID 1304 wrote to memory of 1576	1304	ORDER_REQUEST09467_PDF.exe	28
PID 1304 wrote to memory of 1576	1304	ORDER_REQUEST09467_PDF.exe	28

C:\Users\Admin\AppData\Local\Temp\ORDER_REQUEST09467_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_REQUEST09467_PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 668
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576

memory/1304-0-0x0000000074E30000-0x000000007551E000-memory.dmp

Download

memory/1304-1-0x0000000000B50000-0x0000000000B51000-memory.dmp

Download

memory/1304-3-0x0000000004C40000-0x0000000005440000-memory.dmp

Download

memory/1304-4-0x0000000005E60000-0x0000000005EEC000-memory.dmp

Download

memory/1576-6-0x0000000001E80000-0x0000000001E91000-memory.dmp

Download

memory/1576-9-0x00000000027D0000-0x00000000027E1000-memory.dmp

Download