4fedda898f576336ee03b6171f90a06d6132b314d37e4ff58e1b0a5b1fdc05dc

Analysis

Target
KONTEC QUOTE B1018530 (2).exe
Size 292KB
Sample201013-9vx4vg1ffs
SHA256 4fedda898f576336ee03b6171f90a06d6132b314d37e4ff58e1b0a5b1fdc05dc
MD5 4f7f2aec51d6f089ff11faa851109608
SHA1 57c7fa9f578b30a8ddaad8e2cfceccd28c69bfff
SHA512 458f7edbe8c997091803e032439eaf3658fbfe37d8711d909ef8f1aae5b7035b1fbd3bef69376f900845672a20142dc067dc97ffa4688c1dcd65da49f74ecab7
MD5 SHA1 SHA512

Score

1^/10

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3644	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	KONTEC QUOTE B1018530 (2).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3644	3544	KONTEC QUOTE B1018530 (2).exe	73
PID 3544 wrote to memory of 3644	3544	KONTEC QUOTE B1018530 (2).exe	73
PID 3544 wrote to memory of 3644	3544	KONTEC QUOTE B1018530 (2).exe	73

C:\Users\Admin\AppData\Local\Temp\KONTEC QUOTE B1018530 (2).exe
"C:\Users\Admin\AppData\Local\Temp\KONTEC QUOTE B1018530 (2).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:3644

memory/3544-0-0x0000000073A30000-0x000000007411E000-memory.dmp

Download

memory/3544-1-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/3544-3-0x0000000005650000-0x0000000005651000-memory.dmp

Download