66fb40a5ca213c6ea3377dc16e9e4e25ccd412a1b5da20399c7180d714bc10b0

General

Target
8590473102_G022020000000686.exe
Size 874KB
Sample200818-fla6bbdyv6
SHA256 66fb40a5ca213c6ea3377dc16e9e4e25ccd412a1b5da20399c7180d714bc10b0
MD5 4bbfe74e3b117983e8313afe305c4fee
SHA1 2ee646aac77fef3187e80fddc93b6af4c3c6a4e4
SHA512 c6cec8cb4d54f10742139f81b3a8f02820940295f6b6643f18b90077a1ace4221b01946a635d67d5f13b7c8453d1acf0419c0faed0c91e0f2a090f9b5a1ff299
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	8590473102_G022020000000686.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2768	3952	8590473102_G022020000000686.exe	72
PID 3952 wrote to memory of 2768	3952	8590473102_G022020000000686.exe	72
PID 3952 wrote to memory of 2768	3952	8590473102_G022020000000686.exe	72
PID 3952 wrote to memory of 2884	3952	8590473102_G022020000000686.exe	73
PID 3952 wrote to memory of 2884	3952	8590473102_G022020000000686.exe	73
PID 3952 wrote to memory of 2884	3952	8590473102_G022020000000686.exe	73
PID 3952 wrote to memory of 2556	3952	8590473102_G022020000000686.exe	74
PID 3952 wrote to memory of 2556	3952	8590473102_G022020000000686.exe	74
PID 3952 wrote to memory of 2556	3952	8590473102_G022020000000686.exe	74
PID 3952 wrote to memory of 3032	3952	8590473102_G022020000000686.exe	75
PID 3952 wrote to memory of 3032	3952	8590473102_G022020000000686.exe	75
PID 3952 wrote to memory of 3032	3952	8590473102_G022020000000686.exe	75
PID 3952 wrote to memory of 3492	3952	8590473102_G022020000000686.exe	76
PID 3952 wrote to memory of 3492	3952	8590473102_G022020000000686.exe	76
PID 3952 wrote to memory of 3492	3952	8590473102_G022020000000686.exe	76

C:\Users\Admin\AppData\Local\Temp\8590473102_G022020000000686.exe
"C:\Users\Admin\AppData\Local\Temp\8590473102_G022020000000686.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\8590473102_G022020000000686.exe
  "{path}"
  2⤵
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\8590473102_G022020000000686.exe
  "{path}"
  2⤵
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\8590473102_G022020000000686.exe
  "{path}"
  2⤵
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\8590473102_G022020000000686.exe
  "{path}"
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\8590473102_G022020000000686.exe
  "{path}"
  2⤵
  PID:3492

memory/3952-0-0x0000000073DA0000-0x000000007448E000-memory.dmp

Download

memory/3952-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/3952-3-0x00000000073A0000-0x00000000073A1000-memory.dmp

Download

memory/3952-4-0x0000000006F40000-0x0000000006F41000-memory.dmp

Download

memory/3952-5-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Download

memory/3952-6-0x00000000092D0000-0x00000000092D1000-memory.dmp

Download

memory/3952-7-0x00000000070F0000-0x00000000070F4000-memory.dmp

Download

memory/3952-8-0x00000000096C0000-0x000000000977B000-memory.dmp

Download

memory/3952-9-0x000000000CD10000-0x000000000CDD0000-memory.dmp

Download