b29b726983a48a3f23a92799ff7ade79b1b9baed03a4bfed904f64c8cf2c17cd

Analysis

Target

f129c6db_extracted.exe
Size

154KB
MD5

bfdac41f9d0c9f2e566c6792393578e4
SHA1

dedecc4d3bd586e7b43822291be3f2a801a51e79
SHA256

b29b726983a48a3f23a92799ff7ade79b1b9baed03a4bfed904f64c8cf2c17cd
SHA512

efc77bd7a85e047f579d108925cc5f04d49be53202c66b248768ac06a99ce658cd3c3631c2ab0ccda9233ab10107c506490ae1e1a41608192602a0d74bd1cffa

Score

1^/10

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3056 taskkill.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f129c6db_extracted.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 3920 f129c6db_extracted.exe
Token: SeDebugPrivilege 3056 taskkill.exe

pid	process
3056	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	3920	f129c6db_extracted.exe
Token: SeDebugPrivilege	3056	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f129c6db_extracted.execmd.exe

description	pid	process	target process
PID 3920 wrote to memory of 2280	3920	f129c6db_extracted.exe	cmd.exe
PID 3920 wrote to memory of 2280	3920	f129c6db_extracted.exe	cmd.exe
PID 3920 wrote to memory of 2280	3920	f129c6db_extracted.exe	cmd.exe
PID 2280 wrote to memory of 3056	2280	cmd.exe	taskkill.exe
PID 2280 wrote to memory of 3056	2280	cmd.exe	taskkill.exe
PID 2280 wrote to memory of 3056	2280	cmd.exe	taskkill.exe
PID 2280 wrote to memory of 3636	2280	cmd.exe	choice.exe
PID 2280 wrote to memory of 3636	2280	cmd.exe	choice.exe
PID 2280 wrote to memory of 3636	2280	cmd.exe	choice.exe

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 3920 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f129c6db_extracted.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2280

memory/2280-11-0x0000000000000000-mapping.dmp

Download
memory/3056-12-0x0000000000000000-mapping.dmp

Download
memory/3636-13-0x0000000000000000-mapping.dmp

Download
memory/3920-2-0x0000000073BA0000-0x000000007428E000-memory.dmp

Filesize
6.9MB

Download
memory/3920-3-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/3920-5-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3920-6-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/3920-7-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/3920-8-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/3920-9-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/3920-10-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download