d3312dc17f22aaba92b73f085efc4013f4b910d793608a6c755b2ba4aeebd13d

Analysis

Target
Order List_pdf.exe
Size 912KB
Sample201208-xbfzpet4we
SHA256 d3312dc17f22aaba92b73f085efc4013f4b910d793608a6c755b2ba4aeebd13d
MD5 85775c31dfbb6e0df334838bff7adbad
SHA1 b57886425b42506b17590762f6df79a39d5e0ed0
SHA512 7aec34fa020bfa51dbe4f88744bcd1c1b272f055a59b80aa715ee0a88d8b25a52dd176b5dda56144ea6d68144ef8226a45799c1d33d8b0098489ac04acad1989
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1616	1636	WerFault.exe	24

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1616	1636	Order List_pdf.exe	29
PID 1636 wrote to memory of 1616	1636	Order List_pdf.exe	29
PID 1636 wrote to memory of 1616	1636	Order List_pdf.exe	29
PID 1636 wrote to memory of 1616	1636	Order List_pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\Order List_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order List_pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 728
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616

memory/1616-9-0x0000000001E90000-0x0000000001EA1000-memory.dmp

Download

memory/1616-12-0x00000000028E0000-0x00000000028F1000-memory.dmp

Download

memory/1636-2-0x0000000074590000-0x0000000074C7E000-memory.dmp

Download

memory/1636-3-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/1636-5-0x0000000025850000-0x0000000045838000-memory.dmp

Download

memory/1636-6-0x0000000000330000-0x0000000000338000-memory.dmp

Download