5cd560ec7db038e75c705546d41801264cf450d601cf9b1835826da7597ef921

General

Target
96b09a7227379467f64b9ca40721b76a.exe
Size 1.5MB
Sample210727-pgabklap8j
SHA256 5cd560ec7db038e75c705546d41801264cf450d601cf9b1835826da7597ef921
MD5 96b09a7227379467f64b9ca40721b76a
SHA1 8a28222904f910de66d2620ae4b99d98c322bdb3
SHA512 75086c8e9403834be783667dfad1cc18b756f4df22357520fd1f4a3a863eda0859591f5a0bcb0860ee1876ba6b317b3e600ec2b36a4be26b6e89015460de3031
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	96b09a7227379467f64b9ca40721b76a.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 616	1652	96b09a7227379467f64b9ca40721b76a.exe	29
PID 1652 wrote to memory of 616	1652	96b09a7227379467f64b9ca40721b76a.exe	29
PID 1652 wrote to memory of 616	1652	96b09a7227379467f64b9ca40721b76a.exe	29
PID 1652 wrote to memory of 616	1652	96b09a7227379467f64b9ca40721b76a.exe	29
PID 1652 wrote to memory of 1020	1652	96b09a7227379467f64b9ca40721b76a.exe	30
PID 1652 wrote to memory of 1020	1652	96b09a7227379467f64b9ca40721b76a.exe	30
PID 1652 wrote to memory of 1020	1652	96b09a7227379467f64b9ca40721b76a.exe	30
PID 1652 wrote to memory of 1020	1652	96b09a7227379467f64b9ca40721b76a.exe	30
PID 1652 wrote to memory of 864	1652	96b09a7227379467f64b9ca40721b76a.exe	31
PID 1652 wrote to memory of 864	1652	96b09a7227379467f64b9ca40721b76a.exe	31
PID 1652 wrote to memory of 864	1652	96b09a7227379467f64b9ca40721b76a.exe	31
PID 1652 wrote to memory of 864	1652	96b09a7227379467f64b9ca40721b76a.exe	31
PID 1652 wrote to memory of 564	1652	96b09a7227379467f64b9ca40721b76a.exe	32
PID 1652 wrote to memory of 564	1652	96b09a7227379467f64b9ca40721b76a.exe	32
PID 1652 wrote to memory of 564	1652	96b09a7227379467f64b9ca40721b76a.exe	32
PID 1652 wrote to memory of 564	1652	96b09a7227379467f64b9ca40721b76a.exe	32
PID 1652 wrote to memory of 736	1652	96b09a7227379467f64b9ca40721b76a.exe	33
PID 1652 wrote to memory of 736	1652	96b09a7227379467f64b9ca40721b76a.exe	33
PID 1652 wrote to memory of 736	1652	96b09a7227379467f64b9ca40721b76a.exe	33
PID 1652 wrote to memory of 736	1652	96b09a7227379467f64b9ca40721b76a.exe	33

C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe
"C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe
  "C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe"
  2⤵
  PID:616
- C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe
  "C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe"
  2⤵
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe
  "C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe"
  2⤵
  PID:864
- C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe
  "C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe"
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe
  "C:\Users\Admin\AppData\Local\Temp\96b09a7227379467f64b9ca40721b76a.exe"
  2⤵
  PID:736

memory/1652-60-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/1652-62-0x0000000005010000-0x0000000005011000-memory.dmp

Download

memory/1652-63-0x00000000002D0000-0x00000000002FD000-memory.dmp

Download

memory/1652-64-0x0000000005960000-0x00000000059C1000-memory.dmp

Download

memory/1652-65-0x0000000000300000-0x000000000031D000-memory.dmp

Download