Analysis
-
max time kernel
115s -
max time network
118s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 18:25
Static task
static1
Behavioral task
behavioral1
Sample
DOC-4529464927595.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DOC-4529464927595.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
DOC-4529464927595.exe
-
Size
964KB
-
MD5
01727a09b28fe78b2d958ccafe6a1264
-
SHA1
83036afbf67fac6220141459a1e67a9dc18dc515
-
SHA256
8100e4e4aec4f7f9ca98d640d2c68bfd47f4f7538c041f33157faf8e924d0a74
-
SHA512
719f8e9aba1de854c85922f4dfe2f7f7c96f3aa80d4de2ddd4843ff23289468bd232a53382ad41eedbd06c31349704013a6f1fc3998df4339c54d4f74acfb99a
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
DOC-4529464927595.exepid process 1124 DOC-4529464927595.exe 1124 DOC-4529464927595.exe 1124 DOC-4529464927595.exe 1124 DOC-4529464927595.exe 1124 DOC-4529464927595.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
DOC-4529464927595.exedescription pid process Token: SeDebugPrivilege 1124 DOC-4529464927595.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
DOC-4529464927595.exedescription pid process target process PID 1124 wrote to memory of 1076 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1076 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1076 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1076 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1308 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1308 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1308 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1308 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1428 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1428 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1428 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1428 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1436 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1436 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1436 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1436 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1472 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1472 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1472 1124 DOC-4529464927595.exe DOC-4529464927595.exe PID 1124 wrote to memory of 1472 1124 DOC-4529464927595.exe DOC-4529464927595.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"{path}"2⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"{path}"2⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"{path}"2⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"{path}"2⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"{path}"2⤵PID:1472