2a4f2bb0198262260af505eb3198a4a38dcee62a483f9fa42d55568b9acc53f2

Analysis

max time kernel
157s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 15:42

Target

TR23-USD-33 Incoice of MV ADAMOON.pdf.exe
Size

22KB
MD5

147fa4ff3985efcbf3fb7074bb47f626
SHA1

32123253e38e88ea10d67680f00d3d3416af4f89
SHA256

2a4f2bb0198262260af505eb3198a4a38dcee62a483f9fa42d55568b9acc53f2
SHA512

42ae8edd3cad1cea4175d1ea1fb277d36ef021ea55d67f1fb12e56d154db68accade7b20cb714359dcbc6b552712ef86e804ec6b69858432cd1b756be17b90fb
SSDEEP

384:hZHrkMJ9g0MRp3NPnbn+b/AeH9F9wGjEnAtNCSGFqUt:hZH/y9Pbn+rLXiiEnuCLFqUt

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3512	3500	WerFault.exe	82
4440	3500	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3500	TR23-USD-33 Incoice of MV ADAMOON.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	TR23-USD-33 Incoice of MV ADAMOON.pdf.exe

C:\Users\Admin\AppData\Local\Temp\TR23-USD-33 Incoice of MV ADAMOON.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\TR23-USD-33 Incoice of MV ADAMOON.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1956
  2⤵
  - Program crash
  PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1736
  2⤵
  - Program crash
  PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3500 -ip 3500
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3500 -ip 3500
1⤵
PID:5008

memory/3500-0-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/3500-1-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Filesize
48KB

Download
memory/3500-2-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/3500-3-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/3500-4-0x0000000005B40000-0x0000000005B50000-memory.dmp

Filesize
64KB

Download
memory/3500-5-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download