d7c81b22b82c19f2c3b05ba1b222e317975cc16f4900db415c8e723c7f2eff06

Analysis

Target
samples.exe
Size 681KB
Sample201014-rnvvdvgnws
SHA256 d7c81b22b82c19f2c3b05ba1b222e317975cc16f4900db415c8e723c7f2eff06
MD5 96eaa31af28c16ad4d9a2730a52a0b79
SHA1 acd2d5971eecefaa8b87c82646c9430900997cbf
SHA512 b118bf52badcaaa6dc76cba3f2eaf4fdb0f84fd24260cf2c3c894c3ef66c57a465b32a29b77537664a567644fe1b9b87ebd9baa97d10653d887a5b2b5a041d04
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3844	dw20.exe
3844	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3844	dw20.exe
Token: SeBackupPrivilege	3844	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3844	4036	samples.exe	75
PID 4036 wrote to memory of 3844	4036	samples.exe	75
PID 4036 wrote to memory of 3844	4036	samples.exe	75

C:\Users\Admin\AppData\Local\Temp\samples.exe
"C:\Users\Admin\AppData\Local\Temp\samples.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 856
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844

memory/3844-1-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/3844-2-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/3844-4-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/3844-6-0x0000000002D40000-0x0000000002D41000-memory.dmp

Download

memory/3844-8-0x0000000002D40000-0x0000000002D41000-memory.dmp

Download