04e942767c6c9744ef7eb6d3cc342239b8feaacd4df3c5e542b85177c0fbd97f

Analysis

Target

2.exe
Size

2.7MB
MD5

37798198d3649f8171286118fd320fe2
SHA1

e4d54a7c1dec833f20a6ff922388bac3b0a8546f
SHA256

04e942767c6c9744ef7eb6d3cc342239b8feaacd4df3c5e542b85177c0fbd97f
SHA512

04f6b778a1920686a8c831be6a827df8997c70b5f2148470142748388d8719f78c553ca462000323bc96c9dc0443addaed636687743ed6df159bab3e90e45838

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

2.exe

pid process

1804 2.exe
1804 2.exe
1804 2.exe
1804 2.exe
1804 2.exe
1804 2.exe
1804 2.exe
1804 2.exe
1804 2.exe
1804 2.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2.exe

description pid process

Token: SeDebugPrivilege 1804 2.exe

description	pid	process
Token: SeDebugPrivilege	1804	2.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

2.exe

description	pid	process	target process
PID 1804 wrote to memory of 456	1804	2.exe	2.exe
PID 1804 wrote to memory of 456	1804	2.exe	2.exe
PID 1804 wrote to memory of 456	1804	2.exe	2.exe
PID 1804 wrote to memory of 456	1804	2.exe	2.exe
PID 1804 wrote to memory of 652	1804	2.exe	2.exe
PID 1804 wrote to memory of 652	1804	2.exe	2.exe
PID 1804 wrote to memory of 652	1804	2.exe	2.exe
PID 1804 wrote to memory of 652	1804	2.exe	2.exe
PID 1804 wrote to memory of 464	1804	2.exe	2.exe
PID 1804 wrote to memory of 464	1804	2.exe	2.exe
PID 1804 wrote to memory of 464	1804	2.exe	2.exe
PID 1804 wrote to memory of 464	1804	2.exe	2.exe
PID 1804 wrote to memory of 768	1804	2.exe	2.exe
PID 1804 wrote to memory of 768	1804	2.exe	2.exe
PID 1804 wrote to memory of 768	1804	2.exe	2.exe
PID 1804 wrote to memory of 768	1804	2.exe	2.exe
PID 1804 wrote to memory of 556	1804	2.exe	2.exe
PID 1804 wrote to memory of 556	1804	2.exe	2.exe
PID 1804 wrote to memory of 556	1804	2.exe	2.exe
PID 1804 wrote to memory of 556	1804	2.exe	2.exe

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:456
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:464
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:556

memory/1804-60-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1804-62-0x00000000007F0000-0x0000000000861000-memory.dmp

Filesize
452KB

Download
memory/1804-63-0x00000000005E0000-0x00000000005EF000-memory.dmp

Filesize
60KB

Download
memory/1804-64-0x0000000007040000-0x0000000007041000-memory.dmp

Filesize
4KB

Download