2c80f61e5c61bb87be9e2d60e69093bcb5082fc690fcd751be787dbd118d5e57

Analysis

Target
SecuriteInfo.com.Variant.MSILPerseus.225130.2188.22616.exe
Size 374KB
Sample201109-n5fnndkr5e
SHA256 2c80f61e5c61bb87be9e2d60e69093bcb5082fc690fcd751be787dbd118d5e57
MD5 f50f94d661a547afc199b5f2ac03b0fe
SHA1 6a8674255b61851fe738263f68b83b16ce724716
SHA512 6684bbe7f4ec198762bdd9edf9b12fe78bb6916f3d0c932ff58c3c61b1fac0c4155bc69b93425fb6e0709384fa2d92bf74b9270c6067842878126dcc2109d23d
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	dw20.exe
2920	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2920	dw20.exe
Token: SeBackupPrivilege	2920	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2920	3940	SecuriteInfo.com.Variant.MSILPerseus.225130.2188.22616.exe	75
PID 3940 wrote to memory of 2920	3940	SecuriteInfo.com.Variant.MSILPerseus.225130.2188.22616.exe	75
PID 3940 wrote to memory of 2920	3940	SecuriteInfo.com.Variant.MSILPerseus.225130.2188.22616.exe	75

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILPerseus.225130.2188.22616.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILPerseus.225130.2188.22616.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1540
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

memory/2920-4-0x0000000002A40000-0x0000000002A41000-memory.dmp

Download

memory/2920-5-0x0000000003150000-0x0000000003151000-memory.dmp

Download