038b5ec90419cc38dcfc837ec372f5abbf49b3903501c11b5e3ee8bffc749755

Analysis

Target

TT000900_989990.exe
Size

894KB
MD5

f343cb0399d345b279de6d50d99f4be9
SHA1

6983c9557f3ab79b9a78f069599080d6988fd0c1
SHA256

451e257b591ad6beacf73a6ff2dc67942fa68cdd453da2784e084d790e66d3df
SHA512

109ab328298c9945aafabe0c306b4ba4534171e40d7ef966ed5e5e14fcc4a87d3ebbc3ff4800fd42fcc78c2d9211b37d37461538f8c79ee3e79fdd5fc429fb19

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	TT000900_989990.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1948	1644	TT000900_989990.exe	25
PID 1644 wrote to memory of 1948	1644	TT000900_989990.exe	25
PID 1644 wrote to memory of 1948	1644	TT000900_989990.exe	25
PID 1644 wrote to memory of 1948	1644	TT000900_989990.exe	25
PID 1644 wrote to memory of 1936	1644	TT000900_989990.exe	26
PID 1644 wrote to memory of 1936	1644	TT000900_989990.exe	26
PID 1644 wrote to memory of 1936	1644	TT000900_989990.exe	26
PID 1644 wrote to memory of 1936	1644	TT000900_989990.exe	26
PID 1644 wrote to memory of 1944	1644	TT000900_989990.exe	27
PID 1644 wrote to memory of 1944	1644	TT000900_989990.exe	27
PID 1644 wrote to memory of 1944	1644	TT000900_989990.exe	27
PID 1644 wrote to memory of 1944	1644	TT000900_989990.exe	27
PID 1644 wrote to memory of 1928	1644	TT000900_989990.exe	28
PID 1644 wrote to memory of 1928	1644	TT000900_989990.exe	28
PID 1644 wrote to memory of 1928	1644	TT000900_989990.exe	28
PID 1644 wrote to memory of 1928	1644	TT000900_989990.exe	28
PID 1644 wrote to memory of 1904	1644	TT000900_989990.exe	29
PID 1644 wrote to memory of 1904	1644	TT000900_989990.exe	29
PID 1644 wrote to memory of 1904	1644	TT000900_989990.exe	29
PID 1644 wrote to memory of 1904	1644	TT000900_989990.exe	29

C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe
"C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe
  "C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe"
  2⤵
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe
  "C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe"
  2⤵
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe
  "C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe"
  2⤵
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe
  "C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe"
  2⤵
  PID:1928
- C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe
  "C:\Users\Admin\AppData\Local\Temp\TT000900_989990.exe"
  2⤵
  PID:1904

memory/1644-59-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/1644-61-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/1644-62-0x00000000005F0000-0x0000000000661000-memory.dmp

Filesize
452KB

Download
memory/1644-63-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download