d173b9844be24a9172f2f2adcde3dd65090afa690b1bd952a7da01de33ad60ef

Analysis

Target

d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe
Size

4KB
MD5

b9a1c7dd8171afe0e3fc1524f5eafb18
SHA1

19b79357841b2bcb3438011f4c8e45f7278aeaa9
SHA256

d173b9844be24a9172f2f2adcde3dd65090afa690b1bd952a7da01de33ad60ef
SHA512

d57c9cf4a489dec1f8b17351173e1ffc202e454f214b85e132fbd5d8af2d4a611e50e1a7f85eb0dfce438539aaec3b143d1fafafbaa0def914f6401c5993da6d

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

864 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 864 powershell.exe

pid	process
864	powershell.exe

description	pid	process
Token: SeDebugPrivilege	864	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe

description	pid	process	target process
PID 1648 wrote to memory of 864	1648	d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe	powershell.exe
PID 1648 wrote to memory of 864	1648	d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe	powershell.exe
PID 1648 wrote to memory of 864	1648	d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe
"C:\Users\Admin\AppData\Local\Temp\d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

memory/864-57-0x0000000000000000-mapping.dmp

Download
memory/864-58-0x000007FEFB961000-0x000007FEFB963000-memory.dmp

Filesize
8KB

Download
memory/864-60-0x00000000025E0000-0x00000000025E2000-memory.dmp

Filesize
8KB

Download
memory/864-61-0x00000000025E2000-0x00000000025E4000-memory.dmp

Filesize
8KB

Download
memory/864-62-0x00000000025E4000-0x00000000025E7000-memory.dmp

Filesize
12KB

Download
memory/864-59-0x000007FEF27C0000-0x000007FEF331D000-memory.dmp

Filesize
11.4MB

Download
memory/864-63-0x00000000025EB000-0x000000000260A000-memory.dmp

Filesize
124KB

Download
memory/1648-55-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download