b2ffebf2df5b70d6866b2bb65a56ecafa59371fc78f3690790bb273c715df683

Analysis

Target

01a083f4_extracted.exe
Size

146KB
MD5

c5c6f5d743b1d2391b150c9740db22ba
SHA1

f033a2fab1ad3a6e8d4ab08730654fc6f3482a4e
SHA256

b2ffebf2df5b70d6866b2bb65a56ecafa59371fc78f3690790bb273c715df683
SHA512

6bf5d23f2f82b02dd194716d747b99858823915fccb09b39a842f5a221b2d933e8c53d0158fe4806bde644f96aa9d28699ec4ab702d71e55d93feb0f384f843e

Score

1^/10

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

188 taskkill.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

01a083f4_extracted.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 984 01a083f4_extracted.exe
Token: SeDebugPrivilege 188 taskkill.exe

pid	process
188	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	984	01a083f4_extracted.exe
Token: SeDebugPrivilege	188	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

01a083f4_extracted.execmd.exe

description	pid	process	target process
PID 984 wrote to memory of 4092	984	01a083f4_extracted.exe	cmd.exe
PID 984 wrote to memory of 4092	984	01a083f4_extracted.exe	cmd.exe
PID 984 wrote to memory of 4092	984	01a083f4_extracted.exe	cmd.exe
PID 4092 wrote to memory of 188	4092	cmd.exe	taskkill.exe
PID 4092 wrote to memory of 188	4092	cmd.exe	taskkill.exe
PID 4092 wrote to memory of 188	4092	cmd.exe	taskkill.exe
PID 4092 wrote to memory of 748	4092	cmd.exe	choice.exe
PID 4092 wrote to memory of 748	4092	cmd.exe	choice.exe
PID 4092 wrote to memory of 748	4092	cmd.exe	choice.exe

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 984 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\01a083f4_extracted.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4092

memory/188-13-0x0000000000000000-mapping.dmp

Download
memory/748-14-0x0000000000000000-mapping.dmp

Download
memory/984-2-0x0000000073300000-0x00000000739EE000-memory.dmp

Filesize
6.9MB

Download
memory/984-3-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/984-5-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/984-6-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/984-7-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/984-8-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/984-9-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/984-10-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/984-11-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/4092-12-0x0000000000000000-mapping.dmp

Download