12c21ab50e08cf3517c8c09be4597f0bc0dda3c6790dbc19e540f2d6f0272ae8

General

Target
ae442bf7856a39e487b74862733b7ddc.exe
Size 469KB
Sample211102-js9mjacae9
SHA256 12c21ab50e08cf3517c8c09be4597f0bc0dda3c6790dbc19e540f2d6f0272ae8
MD5 ae442bf7856a39e487b74862733b7ddc
SHA1 2b3dbc5e0318633d9cd7846f02c25677de366e05
SHA512 a8dc414732accec660289c11d60dfa6daff293af45771debd176f69d4ef0753b1830c4f12a54d24015c1d3975154c59fbb2e4988b1ac2fc01509fc5d7feb93a6
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	ae442bf7856a39e487b74862733b7ddc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1004	472	ae442bf7856a39e487b74862733b7ddc.exe	28
PID 472 wrote to memory of 1004	472	ae442bf7856a39e487b74862733b7ddc.exe	28
PID 472 wrote to memory of 1004	472	ae442bf7856a39e487b74862733b7ddc.exe	28
PID 472 wrote to memory of 1004	472	ae442bf7856a39e487b74862733b7ddc.exe	28
PID 472 wrote to memory of 564	472	ae442bf7856a39e487b74862733b7ddc.exe	29
PID 472 wrote to memory of 564	472	ae442bf7856a39e487b74862733b7ddc.exe	29
PID 472 wrote to memory of 564	472	ae442bf7856a39e487b74862733b7ddc.exe	29
PID 472 wrote to memory of 564	472	ae442bf7856a39e487b74862733b7ddc.exe	29
PID 472 wrote to memory of 1124	472	ae442bf7856a39e487b74862733b7ddc.exe	30
PID 472 wrote to memory of 1124	472	ae442bf7856a39e487b74862733b7ddc.exe	30
PID 472 wrote to memory of 1124	472	ae442bf7856a39e487b74862733b7ddc.exe	30
PID 472 wrote to memory of 1124	472	ae442bf7856a39e487b74862733b7ddc.exe	30
PID 472 wrote to memory of 836	472	ae442bf7856a39e487b74862733b7ddc.exe	31
PID 472 wrote to memory of 836	472	ae442bf7856a39e487b74862733b7ddc.exe	31
PID 472 wrote to memory of 836	472	ae442bf7856a39e487b74862733b7ddc.exe	31
PID 472 wrote to memory of 836	472	ae442bf7856a39e487b74862733b7ddc.exe	31
PID 472 wrote to memory of 1924	472	ae442bf7856a39e487b74862733b7ddc.exe	32
PID 472 wrote to memory of 1924	472	ae442bf7856a39e487b74862733b7ddc.exe	32
PID 472 wrote to memory of 1924	472	ae442bf7856a39e487b74862733b7ddc.exe	32
PID 472 wrote to memory of 1924	472	ae442bf7856a39e487b74862733b7ddc.exe	32

C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe
"C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe
  "C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe"
  2⤵
  PID:1004
- C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe
  "C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe"
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe
  "C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe"
  2⤵
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe
  "C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe"
  2⤵
  PID:836
- C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe
  "C:\Users\Admin\AppData\Local\Temp\ae442bf7856a39e487b74862733b7ddc.exe"
  2⤵
  PID:1924

memory/472-54-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download

memory/472-56-0x00000000004F0000-0x00000000004F7000-memory.dmp

Download

memory/472-57-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download

memory/472-58-0x00000000021E0000-0x000000000221E000-memory.dmp

Download