8b1417b74ac31f2e60a6a9f5ed507caf06026191354ce0e4b6bf0816fd3f512d

General

Target

M3WFLelkSqNUdwK.exe
Size

1.1MB
MD5

5b1f37d1452a333b6eeeda0d44161a85
SHA1

1623fd18d15f385f1bfa78259c9af13226aeaa14
SHA256

8b1417b74ac31f2e60a6a9f5ed507caf06026191354ce0e4b6bf0816fd3f512d
SHA512

a46cccfcced1bc0ed23a53c2adec39754515e9cef1f29e3fe3f8178c8f276660071e25d7ee11f2b7b2af0d429fca541bbaa56e38623f36479d235fdc6d27ac72

Score

1^/10

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1916	1448	M3WFLelkSqNUdwK.exe	26
PID 1448 wrote to memory of 1916	1448	M3WFLelkSqNUdwK.exe	26
PID 1448 wrote to memory of 1916	1448	M3WFLelkSqNUdwK.exe	26
PID 1448 wrote to memory of 1916	1448	M3WFLelkSqNUdwK.exe	26
PID 1448 wrote to memory of 1788	1448	M3WFLelkSqNUdwK.exe	28
PID 1448 wrote to memory of 1788	1448	M3WFLelkSqNUdwK.exe	28
PID 1448 wrote to memory of 1788	1448	M3WFLelkSqNUdwK.exe	28
PID 1448 wrote to memory of 1788	1448	M3WFLelkSqNUdwK.exe	28
PID 1448 wrote to memory of 1796	1448	M3WFLelkSqNUdwK.exe	29
PID 1448 wrote to memory of 1796	1448	M3WFLelkSqNUdwK.exe	29
PID 1448 wrote to memory of 1796	1448	M3WFLelkSqNUdwK.exe	29
PID 1448 wrote to memory of 1796	1448	M3WFLelkSqNUdwK.exe	29
PID 1448 wrote to memory of 1780	1448	M3WFLelkSqNUdwK.exe	30
PID 1448 wrote to memory of 1780	1448	M3WFLelkSqNUdwK.exe	30
PID 1448 wrote to memory of 1780	1448	M3WFLelkSqNUdwK.exe	30
PID 1448 wrote to memory of 1780	1448	M3WFLelkSqNUdwK.exe	30
PID 1448 wrote to memory of 1752	1448	M3WFLelkSqNUdwK.exe	31
PID 1448 wrote to memory of 1752	1448	M3WFLelkSqNUdwK.exe	31
PID 1448 wrote to memory of 1752	1448	M3WFLelkSqNUdwK.exe	31
PID 1448 wrote to memory of 1752	1448	M3WFLelkSqNUdwK.exe	31
PID 1448 wrote to memory of 1748	1448	M3WFLelkSqNUdwK.exe	32
PID 1448 wrote to memory of 1748	1448	M3WFLelkSqNUdwK.exe	32
PID 1448 wrote to memory of 1748	1448	M3WFLelkSqNUdwK.exe	32
PID 1448 wrote to memory of 1748	1448	M3WFLelkSqNUdwK.exe	32

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	M3WFLelkSqNUdwK.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1916	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe
"C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1448
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pEhOEsSzUiv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp423D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe
  "{path}"
  2⤵
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe
  "{path}"
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe
  "{path}"
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe
  "{path}"
  2⤵
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\M3WFLelkSqNUdwK.exe
  "{path}"
  2⤵
  PID:1748