2408f4144f6b51601965eef8aaf6d78400e34e6599e59801dc6b5e48d385a077

Resubmissions

12/10/2020, 10:25

06/10/2020, 06:14

Target
New Order - IC Project.exe
Size 603KB
Sample201006-9jn3ythj42
SHA256 2408f4144f6b51601965eef8aaf6d78400e34e6599e59801dc6b5e48d385a077
MD5 4b805a5545f681a0d5d367c3c9010aaf
SHA1 ed9e78fa193220217db5e2badf06274d555bf0a2
SHA512 738a71c22f42eb2802063c57c88f2fe5b6b16281f547e3d6ddec04a83aeff04b177caa523b0b63dbc085eac6f076995a97b63c2c4318ec6122bb508d2bf5c58f
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
864	New Order - IC Project.exe
864	New Order - IC Project.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	New Order - IC Project.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1552	864	New Order - IC Project.exe	28
PID 864 wrote to memory of 1552	864	New Order - IC Project.exe	28
PID 864 wrote to memory of 1552	864	New Order - IC Project.exe	28
PID 864 wrote to memory of 1552	864	New Order - IC Project.exe	28

C:\Users\Admin\AppData\Local\Temp\New Order - IC Project.exe
"C:\Users\Admin\AppData\Local\Temp\New Order - IC Project.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 16796
  2⤵
  PID:1552

memory/1552-1-0x0000000001D70000-0x0000000001D81000-memory.dmp

Download