e8c00468964966dfdbae2de1d15a8a24b5ba4dbe7dddd482888568f4430d4db1

Analysis

Target
Gjybdn.bin.exe
Size 5.1MB
Sample200624-dhy1agh3me
SHA256 e8c00468964966dfdbae2de1d15a8a24b5ba4dbe7dddd482888568f4430d4db1
MD5 95d8ff5f140d41f1330879fc4b659bd2
SHA1 881882a77fdeea242efa4ccdefc164cd4808093f
SHA512 f0f4fc844797cd4e1291660eab4a1c638506456b6a087436e76891b83b3cefa46887e00a168be0c4b682f1bfb6b522580ba104f3fab6e9efa93ae6199b1d9caf
MD5 SHA1 SHA512

Score

7^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4048	3828	Gjybdn.bin.exe	68
PID 3828 wrote to memory of 4048	3828	Gjybdn.bin.exe	68
PID 4048 wrote to memory of 3900	4048	Gjybdn.bin.exe	69
PID 4048 wrote to memory of 3900	4048	Gjybdn.bin.exe	69
PID 4048 wrote to memory of 3860	4048	Gjybdn.bin.exe	70
PID 4048 wrote to memory of 3860	4048	Gjybdn.bin.exe	70

Loads dropped DLL 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	4048	Gjybdn.bin.exe

C:\Users\Admin\AppData\Local\Temp\Gjybdn.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Gjybdn.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Users\Admin\AppData\Local\Temp\Gjybdn.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\Gjybdn.bin.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3860