d9bad692a869fdb2d3e9ec678e50f27e2dbe2f1fef185a8480df7eb5562d88f0

Analysis

Target

gunzipped.exe
Size

202KB
MD5

a76b143e354a2ac9f363616ff4f8b239
SHA1

51bb9b6f0c004d4532ae7f83b58554c924f4d3cc
SHA256

d9bad692a869fdb2d3e9ec678e50f27e2dbe2f1fef185a8480df7eb5562d88f0
SHA512

08caf51783da2b857699ca0063410464e35faeec64a44d4e35ed7e098f5fa6447d36c8a01de7ab9ecbd863e690a910328ccb503e66a9ef679a98031bf5be5369

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

gunzipped.exe

pid process

1660 gunzipped.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

gunzipped.exe

description pid process

Token: SeDebugPrivilege 1660 gunzipped.exe

pid	process
1660	gunzipped.exe

description	pid	process
Token: SeDebugPrivilege	1660	gunzipped.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

gunzipped.exe

description	pid	process	target process
PID 1660 wrote to memory of 1452	1660	gunzipped.exe	Msbuild.exe
PID 1660 wrote to memory of 1452	1660	gunzipped.exe	Msbuild.exe
PID 1660 wrote to memory of 1452	1660	gunzipped.exe	Msbuild.exe
PID 1660 wrote to memory of 1452	1660	gunzipped.exe	Msbuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
2⤵
PID:1452

memory/1660-53-0x00000000011A0000-0x00000000011D4000-memory.dmp

Filesize
208KB

Download
memory/1660-54-0x00000000011A0000-0x00000000011D4000-memory.dmp

Filesize
208KB

Download
memory/1660-55-0x0000000000760000-0x0000000000786000-memory.dmp

Filesize
152KB

Download
memory/1660-56-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/1660-57-0x0000000000780000-0x0000000000788000-memory.dmp

Filesize
32KB

Download
memory/1660-58-0x000000001B170000-0x000000001B172000-memory.dmp

Filesize
8KB

Download