d24b8170ae01b68882734d975036a482dbf4f941af283ffb433fda5f0f820f49

General

Target
fdbcd536c1de437df31a440f35019c03.exe
Size 1.3MB
Sample210812-cdga322fen
SHA256 d24b8170ae01b68882734d975036a482dbf4f941af283ffb433fda5f0f820f49
MD5 fdbcd536c1de437df31a440f35019c03
SHA1 6533c338307aa0acaf49a27d6baa011bb413b6b2
SHA512 54a02e8c6d1717536f9c2219b7a2e823050cf75ce04812d6372792ee850a443189eb8770d93b68e2a8aaaeacd19fb4c051c183d2ee14d597e25b254db5e336b0
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	fdbcd536c1de437df31a440f35019c03.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 1368	592	fdbcd536c1de437df31a440f35019c03.exe	29
PID 592 wrote to memory of 1368	592	fdbcd536c1de437df31a440f35019c03.exe	29
PID 592 wrote to memory of 1368	592	fdbcd536c1de437df31a440f35019c03.exe	29
PID 592 wrote to memory of 1368	592	fdbcd536c1de437df31a440f35019c03.exe	29
PID 592 wrote to memory of 1548	592	fdbcd536c1de437df31a440f35019c03.exe	30
PID 592 wrote to memory of 1548	592	fdbcd536c1de437df31a440f35019c03.exe	30
PID 592 wrote to memory of 1548	592	fdbcd536c1de437df31a440f35019c03.exe	30
PID 592 wrote to memory of 1548	592	fdbcd536c1de437df31a440f35019c03.exe	30
PID 592 wrote to memory of 320	592	fdbcd536c1de437df31a440f35019c03.exe	31
PID 592 wrote to memory of 320	592	fdbcd536c1de437df31a440f35019c03.exe	31
PID 592 wrote to memory of 320	592	fdbcd536c1de437df31a440f35019c03.exe	31
PID 592 wrote to memory of 320	592	fdbcd536c1de437df31a440f35019c03.exe	31
PID 592 wrote to memory of 652	592	fdbcd536c1de437df31a440f35019c03.exe	32
PID 592 wrote to memory of 652	592	fdbcd536c1de437df31a440f35019c03.exe	32
PID 592 wrote to memory of 652	592	fdbcd536c1de437df31a440f35019c03.exe	32
PID 592 wrote to memory of 652	592	fdbcd536c1de437df31a440f35019c03.exe	32
PID 592 wrote to memory of 464	592	fdbcd536c1de437df31a440f35019c03.exe	33
PID 592 wrote to memory of 464	592	fdbcd536c1de437df31a440f35019c03.exe	33
PID 592 wrote to memory of 464	592	fdbcd536c1de437df31a440f35019c03.exe	33
PID 592 wrote to memory of 464	592	fdbcd536c1de437df31a440f35019c03.exe	33

C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe
"C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592
- C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe"
  2⤵
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe"
  2⤵
  PID:1548
- C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe"
  2⤵
  PID:320
- C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe"
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe
  "C:\Users\Admin\AppData\Local\Temp\fdbcd536c1de437df31a440f35019c03.exe"
  2⤵
  PID:464

memory/592-60-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/592-62-0x0000000000260000-0x0000000000278000-memory.dmp

Download

memory/592-63-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/592-64-0x0000000005340000-0x00000000053C4000-memory.dmp

Download

memory/592-65-0x00000000009F0000-0x0000000000A0C000-memory.dmp

Download