46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

Score

1^/10

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

928f1db0c63d122f0183686a3bdfccee.exewmplayer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

928f1db0c63d122f0183686a3bdfccee.exe

description pid process

Token: SeDebugPrivilege 3844 928f1db0c63d122f0183686a3bdfccee.exe

description	pid	process
Token: SeDebugPrivilege	3844	928f1db0c63d122f0183686a3bdfccee.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

928f1db0c63d122f0183686a3bdfccee.exe

description	pid	process	target process
PID 3844 wrote to memory of 3572	3844	928f1db0c63d122f0183686a3bdfccee.exe	wmplayer.exe
PID 3844 wrote to memory of 3572	3844	928f1db0c63d122f0183686a3bdfccee.exe	wmplayer.exe
PID 3844 wrote to memory of 3572	3844	928f1db0c63d122f0183686a3bdfccee.exe	wmplayer.exe
PID 3844 wrote to memory of 3572	3844	928f1db0c63d122f0183686a3bdfccee.exe	wmplayer.exe
PID 3844 wrote to memory of 3572	3844	928f1db0c63d122f0183686a3bdfccee.exe	wmplayer.exe
PID 3844 wrote to memory of 3572	3844	928f1db0c63d122f0183686a3bdfccee.exe	wmplayer.exe
PID 3844 wrote to memory of 3572	3844	928f1db0c63d122f0183686a3bdfccee.exe	wmplayer.exe

C:\Users\Admin\AppData\Local\Temp\foo\928f1db0c63d122f0183686a3bdfccee.exe
"C:\Users\Admin\AppData\Local\Temp\foo\928f1db0c63d122f0183686a3bdfccee.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  -a
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\ProgramData\sh\jpig.buw

MD5
fd525115524318dd876846ff58f14590

SHA1
fb00ea5ea86fa242c7898aec8c759af0984fd2b6

SHA256
5000dc01bc9e844f0515cd5e840902f24aa4f05b889be8e22ab8c979eadc562b

SHA512
052aef52a70b050e2f5beec0a49a052074a980e1b62aef83a139b929908e90678ea0d47add7f7136218c8f8187681b4aa03878103d5b11e6c97f8ad7a8cd7f8e

Download Submit
C:\ProgramData\sh\xcq.eyx

MD5
ff1c4e20057ec46344bff512c0876624

SHA1
ed9aa9aac0b2dcc60f210a83f392b544ee09b700

SHA256
3d5df8ddc17156f694438140e7008564acdb3814920a51fd7e80e17f6799239f

SHA512
3f30cee2aac3d58d3862159fe39d822581c7e3fbf7d88ffee8efcf212003bbc1c06adec3528cb316ab8a00b7da748c9c5946612f1a8ced6bc2171cf4529e3be5

Download Submit
memory/3572-1-0x0000000000000000-mapping.dmp

Download
memory/3572-2-0x0000000000000000-mapping.dmp

Download
memory/3572-3-0x0000000000000000-mapping.dmp

Download
memory/3844-0-0x0000000002A80000-0x0000000002B58000-memory.dmp

Filesize
864KB

Download