0d03382dc9f8a0cbe7657da9f41c7ae26073bcebb74094468acd7cf31e546829

Analysis

Target
BL COPY.exe
Size 1.1MB
Sample201217-akht474wmn
SHA256 0d03382dc9f8a0cbe7657da9f41c7ae26073bcebb74094468acd7cf31e546829
MD5 4d80615f96b90391394f32d176f125af
SHA1 db5f21f41c4c5d7f4585e57f010a8f024a7900fb
SHA512 a5887c11e3306eda09b11899a1b66dc8de89796b3f20088b83fab24c5ff0c4c774954da632640090dac2f660711d863fa1efd7235d96b7c1078709ae2a16faf8
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	dw20.exe
2872	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2872	dw20.exe
Token: SeBackupPrivilege	2872	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 2872	1192	BL COPY.exe	79
PID 1192 wrote to memory of 2872	1192	BL COPY.exe	79
PID 1192 wrote to memory of 2872	1192	BL COPY.exe	79

C:\Users\Admin\AppData\Local\Temp\BL COPY.exe
"C:\Users\Admin\AppData\Local\Temp\BL COPY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 892
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872

memory/2872-3-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/2872-4-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/2872-6-0x0000000002E50000-0x0000000002E51000-memory.dmp

Download

memory/2872-8-0x0000000002E50000-0x0000000002E51000-memory.dmp

Download