5c26b86c312fe7bb9f36e9da309f7b97f0c47a2b53bf9fd8e4cbaf59082a9db3

Analysis

Target

BL-INV and Packing List.exe
Size

460KB
MD5

52905db0d31cf5ab7876b7b1085988c1
SHA1

56c628100f6c44e8845528bfd8ca641bcc24f180
SHA256

5c26b86c312fe7bb9f36e9da309f7b97f0c47a2b53bf9fd8e4cbaf59082a9db3
SHA512

b305c0330972b5a3ad064c6b90c04972b4489563ccae8c2da37b6b7f2933ce57f7820fc2338974ce9bdc45cd778b6acb2936320621be955daba4d56882cf458d

Score

1^/10

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1616	2564	BL-INV and Packing List.exe	69
PID 2564 wrote to memory of 1616	2564	BL-INV and Packing List.exe	69
PID 2564 wrote to memory of 2340	2564	BL-INV and Packing List.exe	70
PID 2564 wrote to memory of 2340	2564	BL-INV and Packing List.exe	70
PID 2564 wrote to memory of 1724	2564	BL-INV and Packing List.exe	71
PID 2564 wrote to memory of 1724	2564	BL-INV and Packing List.exe	71
PID 2564 wrote to memory of 1812	2564	BL-INV and Packing List.exe	72
PID 2564 wrote to memory of 1812	2564	BL-INV and Packing List.exe	72
PID 2564 wrote to memory of 1828	2564	BL-INV and Packing List.exe	73
PID 2564 wrote to memory of 1828	2564	BL-INV and Packing List.exe	73

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	BL-INV and Packing List.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

C:\Users\Admin\AppData\Local\Temp\BL-INV and Packing List.exe
"C:\Users\Admin\AppData\Local\Temp\BL-INV and Packing List.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2564
- C:\Users\Admin\AppData\Local\Temp\BL-INV and Packing List.exe
  "{path}"
  2⤵
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\BL-INV and Packing List.exe
  "{path}"
  2⤵
  PID:2340
- C:\Users\Admin\AppData\Local\Temp\BL-INV and Packing List.exe
  "{path}"
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\BL-INV and Packing List.exe
  "{path}"
  2⤵
  PID:1812
- C:\Users\Admin\AppData\Local\Temp\BL-INV and Packing List.exe
  "{path}"
  2⤵
  PID:1828