e0cb1fe1256cbf26178ffac07b55cdbd9ed9e9cd53d1d2642f8ba43db84cf8b4

Analysis

Target
mcaceres.exe
Size 699KB
Sample201118-b51ldf7cln
SHA256 e0cb1fe1256cbf26178ffac07b55cdbd9ed9e9cd53d1d2642f8ba43db84cf8b4
MD5 547dc41c35d76c0d125ba2b6cfa32a1b
SHA1 9898c5e3ef2d6667d2534f8afda6d1d02b5defeb
SHA512 fe1fac368a998f4078dbdb4857b2087f554354b0ce7b2691463c99fc5ccb6fe5dee42f7f89162eb1ef4c6ab9e98aa8158d07d5231e01b9f80648de16d28ded7f
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	mcaceres.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 780	1032	mcaceres.exe	29
PID 1032 wrote to memory of 780	1032	mcaceres.exe	29
PID 1032 wrote to memory of 780	1032	mcaceres.exe	29
PID 1032 wrote to memory of 780	1032	mcaceres.exe	29
PID 1032 wrote to memory of 1056	1032	mcaceres.exe	30
PID 1032 wrote to memory of 1056	1032	mcaceres.exe	30
PID 1032 wrote to memory of 1056	1032	mcaceres.exe	30
PID 1032 wrote to memory of 1056	1032	mcaceres.exe	30
PID 1032 wrote to memory of 1052	1032	mcaceres.exe	31
PID 1032 wrote to memory of 1052	1032	mcaceres.exe	31
PID 1032 wrote to memory of 1052	1032	mcaceres.exe	31
PID 1032 wrote to memory of 1052	1032	mcaceres.exe	31
PID 1032 wrote to memory of 1316	1032	mcaceres.exe	32
PID 1032 wrote to memory of 1316	1032	mcaceres.exe	32
PID 1032 wrote to memory of 1316	1032	mcaceres.exe	32
PID 1032 wrote to memory of 1316	1032	mcaceres.exe	32
PID 1032 wrote to memory of 1828	1032	mcaceres.exe	33
PID 1032 wrote to memory of 1828	1032	mcaceres.exe	33
PID 1032 wrote to memory of 1828	1032	mcaceres.exe	33
PID 1032 wrote to memory of 1828	1032	mcaceres.exe	33

C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
"C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
  "C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
  2⤵
  PID:780
- C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
  "C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
  2⤵
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
  "C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
  2⤵
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
  "C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
  2⤵
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\mcaceres.exe
  "C:\Users\Admin\AppData\Local\Temp\mcaceres.exe"
  2⤵
  PID:1828

memory/1032-0-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Download

memory/1032-1-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/1032-3-0x0000000000550000-0x0000000000564000-memory.dmp

Download

memory/1032-4-0x0000000007250000-0x00000000072BE000-memory.dmp

Download

memory/1032-5-0x0000000000610000-0x0000000000616000-memory.dmp

Download

memory/1032-6-0x00000000020B0000-0x00000000020E9000-memory.dmp

Download