e734cfb1c78da531edac0e5772b8892c4995862bffb6e8f5eb4bbc7a2090c174

Analysis

Target

Shipping Documents.exe
Size

590KB
MD5

e87f847dd6aea20684b67ab3eab8e992
SHA1

24531e53a0cffd0d4772bebebad7eb5a5071dfec
SHA256

e734cfb1c78da531edac0e5772b8892c4995862bffb6e8f5eb4bbc7a2090c174
SHA512

c222f478e1028cf7591f9f612dcb449e8b1e5278a608c665388a4338105afabab4d253f5738c4db678ed1a1770258083dd15560a135b2560e3860e242c05c057

Score

1^/10

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1508	1164	Shipping Documents.exe	24
PID 1164 wrote to memory of 1508	1164	Shipping Documents.exe	24
PID 1164 wrote to memory of 1508	1164	Shipping Documents.exe	24
PID 1164 wrote to memory of 1508	1164	Shipping Documents.exe	24
PID 1164 wrote to memory of 1580	1164	Shipping Documents.exe	25
PID 1164 wrote to memory of 1580	1164	Shipping Documents.exe	25
PID 1164 wrote to memory of 1580	1164	Shipping Documents.exe	25
PID 1164 wrote to memory of 1580	1164	Shipping Documents.exe	25
PID 1164 wrote to memory of 284	1164	Shipping Documents.exe	26
PID 1164 wrote to memory of 284	1164	Shipping Documents.exe	26
PID 1164 wrote to memory of 284	1164	Shipping Documents.exe	26
PID 1164 wrote to memory of 284	1164	Shipping Documents.exe	26
PID 1164 wrote to memory of 272	1164	Shipping Documents.exe	27
PID 1164 wrote to memory of 272	1164	Shipping Documents.exe	27
PID 1164 wrote to memory of 272	1164	Shipping Documents.exe	27
PID 1164 wrote to memory of 272	1164	Shipping Documents.exe	27
PID 1164 wrote to memory of 1632	1164	Shipping Documents.exe	28
PID 1164 wrote to memory of 1632	1164	Shipping Documents.exe	28
PID 1164 wrote to memory of 1632	1164	Shipping Documents.exe	28
PID 1164 wrote to memory of 1632	1164	Shipping Documents.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	Shipping Documents.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1164
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
  "{path}"
  2⤵
  PID:1508
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
  "{path}"
  2⤵
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
  "{path}"
  2⤵
  PID:284
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
  "{path}"
  2⤵
  PID:272
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
  "{path}"
  2⤵
  PID:1632