46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

Score

1^/10

Suspicious behavior: EnumeratesProcesses 52 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	928f1db0c63d122f0183686a3bdfccee.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1484	996	928f1db0c63d122f0183686a3bdfccee.exe	24
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25
PID 996 wrote to memory of 1120	996	928f1db0c63d122f0183686a3bdfccee.exe	25

C:\Users\Admin\AppData\Local\Temp\foo\928f1db0c63d122f0183686a3bdfccee.exe
"C:\Users\Admin\AppData\Local\Temp\foo\928f1db0c63d122f0183686a3bdfccee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Windows Media Player\wmlaunch.exe
  -y
  2⤵
  PID:1484
- C:\Program Files (x86)\Windows Media Player\wmpshare.exe
  -lo
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120

memory/996-0-0x0000000002A20000-0x0000000002AF8000-memory.dmp

Filesize
864KB

Download