3bdd75cf5a2b26bbf10f298f3071b2d7c7a79b33f880eb3f26c3276baceaac1f

Analysis

Target

7.exe
Size

267KB
MD5

088ef2cfabd6e8b52832f5e358bfff6b
SHA1

4c389ccc2ac9809b315b5ba1b3d3fe3edcf9876d
SHA256

3bdd75cf5a2b26bbf10f298f3071b2d7c7a79b33f880eb3f26c3276baceaac1f
SHA512

0101392d09c48ab7d70582f267dc86d765c77161cfc34ec8cc0ff0a527a46178b4c487a0810a946caab28c4ae6d03cb7134dad0dee13e5563a53135b1c1f992c

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

7.exe

pid process

1672 7.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7.exe

description pid process

Token: SeDebugPrivilege 1672 7.exe

pid	process
1672	7.exe

description	pid	process
Token: SeDebugPrivilege	1672	7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7.exe

description	pid	process	target process
PID 1672 wrote to memory of 1876	1672	7.exe	aspnet_compiler.exe
PID 1672 wrote to memory of 1876	1672	7.exe	aspnet_compiler.exe
PID 1672 wrote to memory of 1876	1672	7.exe	aspnet_compiler.exe
PID 1672 wrote to memory of 1876	1672	7.exe	aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:1876

memory/1672-53-0x00000000012D0000-0x0000000001314000-memory.dmp

Filesize
272KB

Download
memory/1672-54-0x00000000012D0000-0x0000000001314000-memory.dmp

Filesize
272KB

Download
memory/1672-55-0x0000000000CB0000-0x0000000000CF0000-memory.dmp

Filesize
256KB

Download
memory/1672-56-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/1672-57-0x000000001AF70000-0x000000001AF72000-memory.dmp

Filesize
8KB

Download