ee41bffec9b30b0e5e1ee01e07482c92ea0f0663734833e3ac76de4e6388f025

Analysis

Target
PO_354688976.exe
Size 249KB
Sample201013-3nlsny262n
SHA256 ee41bffec9b30b0e5e1ee01e07482c92ea0f0663734833e3ac76de4e6388f025
MD5 8e3ea2c9c7bb2f5a57171eb8b5cbb734
SHA1 255138da02454739ec8b9fc927a486e0bb77f3b7
SHA512 a351d2ba00cd3dd245f633b00ef413518a18c9fe7bd089c83f34d19c14b4959c3cc46a57a09c9052d9d4d226fd80c5b33acf6df5aaad1062637a73b710cf7cf6
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
500	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	PO_354688976.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 500	3412	PO_354688976.exe	72
PID 3412 wrote to memory of 500	3412	PO_354688976.exe	72
PID 3412 wrote to memory of 500	3412	PO_354688976.exe	72

C:\Users\Admin\AppData\Local\Temp\PO_354688976.exe
"C:\Users\Admin\AppData\Local\Temp\PO_354688976.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:500

memory/3412-0-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/3412-1-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/3412-3-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download