f56ecbfb3ff67a82d23b8ddfa5f8cb46fc23b429056e02abddf30bff0630ec29

Analysis

Target
REMMITANCE COPY.exe
Size 1.3MB
Sample210817-7mr3fp76ex
SHA256 f56ecbfb3ff67a82d23b8ddfa5f8cb46fc23b429056e02abddf30bff0630ec29
MD5 5517a5a24eb90ec623923f8c8ec5541d
SHA1 7e802c60004b1ea1227e8f8734d5794c244eff39
SHA512 b0eb706384e4bea33ce63387e405fa0105a56d62d5886bb1d5559405b74449b3095c110aee5997fecab2c37cee9b3c00bc3100793c3d131588419fe8e2a8ee3d
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	dw20.exe
1888	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1888	dw20.exe
Token: SeBackupPrivilege	1888	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1888	3164	REMMITANCE COPY.exe	79
PID 3164 wrote to memory of 1888	3164	REMMITANCE COPY.exe	79
PID 3164 wrote to memory of 1888	3164	REMMITANCE COPY.exe	79

C:\Users\Admin\AppData\Local\Temp\REMMITANCE COPY.exe
"C:\Users\Admin\AppData\Local\Temp\REMMITANCE COPY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 920
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1888

memory/3164-114-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download

memory/3164-115-0x0000000002B11000-0x0000000002B12000-memory.dmp

Download