4e084a7c4023a643e234158d6471d9dce991aa0f1d9a730c1f5e71c9fd42dbf0

General

Target
order8846733.exe
Size 665KB
Sample210703-2r7asls2ts
SHA256 4e084a7c4023a643e234158d6471d9dce991aa0f1d9a730c1f5e71c9fd42dbf0
MD5 37f886ce95ab55fd0b5b8f9e8ee28e5b
SHA1 aabb84cb96e391cb2fa0733de892f774f46ef392
SHA512 93c8e32599a84488dc9529d35b6b13c58cbfd46fe26ffe731efc13c2a882643b187dc77bac1c834aefb53287bbe434ac65b834c06fc08fd8f97ab1b6481cd924
MD5 SHA1 SHA512

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1444	1732	order8846733.exe	32

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	order8846733.exe
Token: SeDebugPrivilege	1444	order8846733.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 556	1732	order8846733.exe	29
PID 1732 wrote to memory of 556	1732	order8846733.exe	29
PID 1732 wrote to memory of 556	1732	order8846733.exe	29
PID 1732 wrote to memory of 556	1732	order8846733.exe	29
PID 1732 wrote to memory of 1712	1732	order8846733.exe	30
PID 1732 wrote to memory of 1712	1732	order8846733.exe	30
PID 1732 wrote to memory of 1712	1732	order8846733.exe	30
PID 1732 wrote to memory of 1712	1732	order8846733.exe	30
PID 1732 wrote to memory of 1352	1732	order8846733.exe	31
PID 1732 wrote to memory of 1352	1732	order8846733.exe	31
PID 1732 wrote to memory of 1352	1732	order8846733.exe	31
PID 1732 wrote to memory of 1352	1732	order8846733.exe	31
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32
PID 1732 wrote to memory of 1444	1732	order8846733.exe	32

C:\Users\Admin\AppData\Local\Temp\order8846733.exe
"C:\Users\Admin\AppData\Local\Temp\order8846733.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  2⤵
  PID:556
- C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  2⤵
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  C:\Users\Admin\AppData\Local\Temp\order8846733.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1444

memory/1444-69-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1444-71-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/1444-73-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/1732-59-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/1732-61-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/1732-62-0x0000000004D60000-0x0000000004DCA000-memory.dmp

Download

memory/1732-63-0x0000000004CA5000-0x0000000004CB6000-memory.dmp

Download

memory/1732-68-0x0000000007D30000-0x0000000007D8A000-memory.dmp

Download