a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10

Analysis

Target
a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe
Size 202KB
Sample220220-efb4aahdfq
SHA256 a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10
MD5 fd1f7a77ea9efd1f2e291c031f441c74
SHA1 c5fdb9dc74560446c9404e01ce176b02899e89e4
SHA512 b4d93fbde71c50f62bedd5ff4d1c81ad7e925ea4bed0df3bf562cdf97b60691ae6d668f9f45615de5eaf8ef2e28dea9a28b197146857223b3d2d9a0c9d436282
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2896	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	51
PID 4816 wrote to memory of 2916	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	23
PID 4816 wrote to memory of 2956	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	50
PID 4816 wrote to memory of 3008	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	48
PID 4816 wrote to memory of 3260	4816	a1c2e6660cff8d87a924ed0079f94374d04602433014c46ae6c52700c45ddc10.exe	24

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3008

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2956

memory/2896-130-0x00007FF7F03F0000-0x00007FF7F06CA000-memory.dmp

Download

memory/2916-131-0x00007FF7F03F0000-0x00007FF7F06CA000-memory.dmp

Download