7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5

Analysis

Target
7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5.exe
Size 540KB
Sample201014-87aagjw8js
SHA256 7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5
MD5 14387dc5cc8b9755dc54372c54ac1911
SHA1 f2aec0bd8bac6dea17ee8c0cf023a4dbb1cbb24a
SHA512 fcd0b8bf877c31fe3f9c631ed2e1c9e7a57ee6ea802767ac881d32b37fc6ecf832635569356d50f43705ab4655735e5612cad8639d1db0978e1fc14b0f042078
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	dw20.exe
1716	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1716	dw20.exe
Token: SeBackupPrivilege	1716	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1716	3288	7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5.exe	75
PID 3288 wrote to memory of 1716	3288	7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5.exe	75
PID 3288 wrote to memory of 1716	3288	7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5.exe	75

C:\Users\Admin\AppData\Local\Temp\7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5.exe
"C:\Users\Admin\AppData\Local\Temp\7ce968d0fc6d6ef86fa1c73e383a21b7cdd401eeaa9daefad0d2b20de042a8e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 856
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1716

memory/1716-1-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/1716-2-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/1716-4-0x0000000002F50000-0x0000000002F51000-memory.dmp

Download

memory/1716-6-0x0000000002F50000-0x0000000002F51000-memory.dmp

Download

memory/1716-7-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download