39cd5c2dd4929b254d9ef4bf758ce2401e49fd5da55ae97ad1939db2cc3acdce

Analysis

Target

000100049000TK.exe
Size

955KB
MD5

113f59d0bd4384226e40c17bf899935d
SHA1

4bf159402cefe87d328182fee0e82297b1fff5c5
SHA256

b77f7c59b071608e552cf6ccae6f9e0e3f6790d83ec7d163713b0eedc6eccf25
SHA512

d8e3717916475013e8ec8cc5a5fef303c4467fe66b944f1031ee73ad964a6a699d3c872a305173ac7565e5000ade605e8cef1cbe3ca9438ac1f85993a69a3b78

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	308	000100049000TK.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1980	308	000100049000TK.exe	26
PID 308 wrote to memory of 1980	308	000100049000TK.exe	26
PID 308 wrote to memory of 1980	308	000100049000TK.exe	26
PID 308 wrote to memory of 1980	308	000100049000TK.exe	26
PID 308 wrote to memory of 1236	308	000100049000TK.exe	27
PID 308 wrote to memory of 1236	308	000100049000TK.exe	27
PID 308 wrote to memory of 1236	308	000100049000TK.exe	27
PID 308 wrote to memory of 1236	308	000100049000TK.exe	27
PID 308 wrote to memory of 1968	308	000100049000TK.exe	28
PID 308 wrote to memory of 1968	308	000100049000TK.exe	28
PID 308 wrote to memory of 1968	308	000100049000TK.exe	28
PID 308 wrote to memory of 1968	308	000100049000TK.exe	28
PID 308 wrote to memory of 2000	308	000100049000TK.exe	29
PID 308 wrote to memory of 2000	308	000100049000TK.exe	29
PID 308 wrote to memory of 2000	308	000100049000TK.exe	29
PID 308 wrote to memory of 2000	308	000100049000TK.exe	29
PID 308 wrote to memory of 1956	308	000100049000TK.exe	30
PID 308 wrote to memory of 1956	308	000100049000TK.exe	30
PID 308 wrote to memory of 1956	308	000100049000TK.exe	30
PID 308 wrote to memory of 1956	308	000100049000TK.exe	30

C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe
"C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe
  "C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe"
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe
  "C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe"
  2⤵
  PID:1236
- C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe
  "C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe"
  2⤵
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe
  "C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe"
  2⤵
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe
  "C:\Users\Admin\AppData\Local\Temp\000100049000TK.exe"
  2⤵
  PID:1956

memory/308-59-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/308-61-0x0000000004860000-0x00000000048D1000-memory.dmp

Filesize
452KB

Download
memory/308-62-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/308-63-0x0000000000320000-0x000000000032F000-memory.dmp

Filesize
60KB

Download