9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17

Analysis

Target

9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe
Size

130KB
MD5

aef8a240881322a88d3dafcfdb19ed8a
SHA1

29abad9d694a43dafa56e589b07d007128f3063b
SHA256

9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17
SHA512

2a27de732fa573181aa2141edfca463324f60905ecc56702b6564d05dd7bf02d06201d4c71edb989ff89172016e254302752ae5ec5ab300176db569716c89268

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe

pid	process
1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe
1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe

description pid process

Token: SeDebugPrivilege 1728 9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe

description	pid	process
Token: SeDebugPrivilege	1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe

description	pid	process	target process
PID 1728 wrote to memory of 2280	1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe	sihost.exe
PID 1728 wrote to memory of 2336	1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe	svchost.exe
PID 1728 wrote to memory of 2460	1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe	taskhostw.exe
PID 1728 wrote to memory of 2436	1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe	Explorer.EXE
PID 1728 wrote to memory of 508	1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe	svchost.exe
PID 1728 wrote to memory of 3272	1728	9fe66773c84d371ef1b424005996ade4d5e16fb00306a1d54b107b2b2d03fe17.exe	DllHost.exe

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2460

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2336

memory/2280-130-0x00007FF79B9E0000-0x00007FF79BD63000-memory.dmp

Filesize
3.5MB

Download