3fcfdfcf1b6e70b28e91b0f0899bd4a745265c9f0ed1963249aa9b2dab14bd68

Analysis

Target
DOCSx.document.eml.exe
Size 872KB
Sample201208-3bzc55xltj
SHA256 3fcfdfcf1b6e70b28e91b0f0899bd4a745265c9f0ed1963249aa9b2dab14bd68
MD5 5f2d04d51006a733f4a97c20af7722cc
SHA1 59ea8c2a3b17813846c7380017984ca959325a2a
SHA512 dc09cedacf73cbd0f5a89e73fccea1f24e47bdc7b82f060000822eafa80136de1dc65b2f0040f83c0903b4c7ad46a5acca614b95a8b4f2d94755ff11d11fea84
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4156	dw20.exe
4156	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	4156	dw20.exe
Token: SeBackupPrivilege	4156	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4156	4768	DOCSx.document.eml.exe	78
PID 4768 wrote to memory of 4156	4768	DOCSx.document.eml.exe	78
PID 4768 wrote to memory of 4156	4768	DOCSx.document.eml.exe	78

C:\Users\Admin\AppData\Local\Temp\DOCSx.document.eml.exe
"C:\Users\Admin\AppData\Local\Temp\DOCSx.document.eml.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 860
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4156

memory/4156-3-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

memory/4156-4-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

memory/4156-6-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

memory/4156-8-0x0000000003010000-0x0000000003011000-memory.dmp

Download