afd34bbcb2f23723f06c6cfcca2d802b15b78cbb6d74b4cdefd49b8b230c1f4f

Analysis

Target
Inquiry No 3308.exe
Size 534KB
Sample201014-sr7c1k87yx
SHA256 afd34bbcb2f23723f06c6cfcca2d802b15b78cbb6d74b4cdefd49b8b230c1f4f
MD5 2cdc1b5f91094744f775388069b3e363
SHA1 1e3311c6ec92ad10c32c543f57716fe005fa53f3
SHA512 2f4070a569c558741c72014f3d37c02ae63f7fef37ba6ef6886d3b3c908f8813fafadc4c07365e97fd598cc71618710e807b996496e36dcf8e126ca4e8ca94c5
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1452	dw20.exe
1452	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1452	dw20.exe
Token: SeBackupPrivilege	1452	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 1452	3700	Inquiry No 3308.exe	76
PID 3700 wrote to memory of 1452	3700	Inquiry No 3308.exe	76
PID 3700 wrote to memory of 1452	3700	Inquiry No 3308.exe	76

C:\Users\Admin\AppData\Local\Temp\Inquiry No 3308.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry No 3308.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 848
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1452

memory/1452-1-0x0000000002980000-0x0000000002981000-memory.dmp

Download

memory/1452-2-0x0000000002D30000-0x0000000002D31000-memory.dmp

Download