a476fbd9ad9588a76e607bfe483d7f7561576fbabddce45b2b6fea4b78ae03a7

Analysis

Target
umu1.exe
Size 992KB
Sample201201-x977b98dca
SHA256 a476fbd9ad9588a76e607bfe483d7f7561576fbabddce45b2b6fea4b78ae03a7
MD5 1ad9ffe1adb8da06efd49bd5423d7575
SHA1 c698f5279da8b78d8d66017a9749c51b50c8d259
SHA512 09d76a9b1653ab05b772753c4f24482563440ccd46fe9ff000f9c44983b083df32748950566286d54a7080dfab91e583a05cba373193268319b573e81f694490
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	umu1.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1728	1684	umu1.exe	29
PID 1684 wrote to memory of 1728	1684	umu1.exe	29
PID 1684 wrote to memory of 1728	1684	umu1.exe	29
PID 1684 wrote to memory of 1728	1684	umu1.exe	29
PID 1684 wrote to memory of 1704	1684	umu1.exe	30
PID 1684 wrote to memory of 1704	1684	umu1.exe	30
PID 1684 wrote to memory of 1704	1684	umu1.exe	30
PID 1684 wrote to memory of 1704	1684	umu1.exe	30
PID 1684 wrote to memory of 1568	1684	umu1.exe	31
PID 1684 wrote to memory of 1568	1684	umu1.exe	31
PID 1684 wrote to memory of 1568	1684	umu1.exe	31
PID 1684 wrote to memory of 1568	1684	umu1.exe	31
PID 1684 wrote to memory of 1064	1684	umu1.exe	32
PID 1684 wrote to memory of 1064	1684	umu1.exe	32
PID 1684 wrote to memory of 1064	1684	umu1.exe	32
PID 1684 wrote to memory of 1064	1684	umu1.exe	32
PID 1684 wrote to memory of 872	1684	umu1.exe	33
PID 1684 wrote to memory of 872	1684	umu1.exe	33
PID 1684 wrote to memory of 872	1684	umu1.exe	33
PID 1684 wrote to memory of 872	1684	umu1.exe	33

C:\Users\Admin\AppData\Local\Temp\umu1.exe
"C:\Users\Admin\AppData\Local\Temp\umu1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\umu1.exe
  "C:\Users\Admin\AppData\Local\Temp\umu1.exe"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\umu1.exe
  "C:\Users\Admin\AppData\Local\Temp\umu1.exe"
  2⤵
  PID:1704
- C:\Users\Admin\AppData\Local\Temp\umu1.exe
  "C:\Users\Admin\AppData\Local\Temp\umu1.exe"
  2⤵
  PID:1568
- C:\Users\Admin\AppData\Local\Temp\umu1.exe
  "C:\Users\Admin\AppData\Local\Temp\umu1.exe"
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\umu1.exe
  "C:\Users\Admin\AppData\Local\Temp\umu1.exe"
  2⤵
  PID:872

memory/1684-2-0x0000000074110000-0x00000000747FE000-memory.dmp

Download

memory/1684-3-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/1684-5-0x00000000257C0000-0x00000000457A8000-memory.dmp

Download

memory/1684-6-0x0000000004930000-0x0000000004986000-memory.dmp

Download

memory/1684-7-0x00000000005C0000-0x00000000005C8000-memory.dmp

Download

memory/1684-9-0x0000000000730000-0x0000000000769000-memory.dmp

Download