8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd

Analysis

Target

8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
Size

155KB
MD5

b5b82647f5478d76c7a6d03f56a4a5d4
SHA1

adc613169ac58740eb92aa9e8bbd163f4c0079c0
SHA256

8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd
SHA512

9cc88fe37bb0d21002b18916358c1d24ad1f10dabbbf952193536680aac1df3fc96dfab40d28a59c74c5186724fbda2c4227c090710d2ee2aafb6aebefb1b7d1

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe

pid	process
1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe

description pid process

Token: SeDebugPrivilege 1700 8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe

description	pid	process
Token: SeDebugPrivilege	1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe

description	pid	process	target process
PID 1700 wrote to memory of 1560	1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
PID 1700 wrote to memory of 1560	1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
PID 1700 wrote to memory of 1560	1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
PID 1700 wrote to memory of 1560	1700	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe	8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe

C:\Users\Admin\AppData\Local\Temp\8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
"C:\Users\Admin\AppData\Local\Temp\8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
  C:\Users\Admin\AppData\Local\Temp\8b191797f59eed06a02682638aef669c467eb1b0a205f4e525bd1ec0b1d13ddd.exe
  2⤵
  PID:1560

memory/1700-55-0x0000000000BF0000-0x0000000000C1C000-memory.dmp

Filesize
176KB

Download
memory/1700-56-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download
memory/1700-57-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/1700-58-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1700-59-0x000000000039D000-0x000000000039F000-memory.dmp

Filesize
8KB

Download
memory/1700-60-0x000000000039D000-0x000000000039F000-memory.dmp

Filesize
8KB

Download
memory/1700-62-0x000000000039D000-0x000000000039F000-memory.dmp

Filesize
8KB

Download
memory/1700-61-0x000000000039D000-0x000000000039F000-memory.dmp

Filesize
8KB

Download
memory/1700-63-0x0000000004DD5000-0x0000000004DE6000-memory.dmp

Filesize
68KB

Download