060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7

Analysis

Target

060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe
Size

592KB
MD5

703fa7aea54ba069f48ea3ef1d33a5ea
SHA1

620a2ada97578ad6074010afb1a159c0ba150299
SHA256

060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7
SHA512

df53c1d32e9c5ef3a631aaa13bb306b2149007d863f86ec525ad832050aa31f6a79f6c595ca669bb871a5da4465b4d50483067562fb1b5693374a1c8f4311535

Score

8^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe
1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe
1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe

Loads dropped DLL 1 IoCs

pid	Process
1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24
PID 1460 wrote to memory of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1460 set thread context of 308	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe	24

Executes dropped EXE 1 IoCs

pid	Process
308	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1460	060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe

C:\Users\Admin\AppData\Local\Temp\060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe
"C:\Users\Admin\AppData\Local\Temp\060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1460
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  PID:308