04e942767c6c9744ef7eb6d3cc342239b8feaacd4df3c5e542b85177c0fbd97f

Analysis

Target

2.exe
Size

2.7MB
MD5

37798198d3649f8171286118fd320fe2
SHA1

e4d54a7c1dec833f20a6ff922388bac3b0a8546f
SHA256

04e942767c6c9744ef7eb6d3cc342239b8feaacd4df3c5e542b85177c0fbd97f
SHA512

04f6b778a1920686a8c831be6a827df8997c70b5f2148470142748388d8719f78c553ca462000323bc96c9dc0443addaed636687743ed6df159bab3e90e45838

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	2.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 456	1804	2.exe	29
PID 1804 wrote to memory of 456	1804	2.exe	29
PID 1804 wrote to memory of 456	1804	2.exe	29
PID 1804 wrote to memory of 456	1804	2.exe	29
PID 1804 wrote to memory of 652	1804	2.exe	30
PID 1804 wrote to memory of 652	1804	2.exe	30
PID 1804 wrote to memory of 652	1804	2.exe	30
PID 1804 wrote to memory of 652	1804	2.exe	30
PID 1804 wrote to memory of 464	1804	2.exe	31
PID 1804 wrote to memory of 464	1804	2.exe	31
PID 1804 wrote to memory of 464	1804	2.exe	31
PID 1804 wrote to memory of 464	1804	2.exe	31
PID 1804 wrote to memory of 768	1804	2.exe	32
PID 1804 wrote to memory of 768	1804	2.exe	32
PID 1804 wrote to memory of 768	1804	2.exe	32
PID 1804 wrote to memory of 768	1804	2.exe	32
PID 1804 wrote to memory of 556	1804	2.exe	33
PID 1804 wrote to memory of 556	1804	2.exe	33
PID 1804 wrote to memory of 556	1804	2.exe	33
PID 1804 wrote to memory of 556	1804	2.exe	33

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:456
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:464
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:768
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  PID:556

memory/1804-60-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1804-62-0x00000000007F0000-0x0000000000861000-memory.dmp

Filesize
452KB

Download
memory/1804-63-0x00000000005E0000-0x00000000005EF000-memory.dmp

Filesize
60KB

Download
memory/1804-64-0x0000000007040000-0x0000000007041000-memory.dmp

Filesize
4KB

Download