75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1

Analysis

Target

75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
Size

209KB
MD5

4d409f1fc90b86f5893a8ad63d0d4b84
SHA1

4c7a52b0def17ab668c2bc0dbfa43d56360d0786
SHA256

75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1
SHA512

fdfc68a0d4cc76b38ddede9c2b3fd55719554aff48e73ff3c4e4d0a35ac6b0436501a8e3e9e72385e72a61dcb3fa3f0dc4c4a22824ff06e7859a169ab7fc7b82

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

pid	process
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe
4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

description pid process

Token: SeDebugPrivilege 4556 75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

description	pid	process
Token: SeDebugPrivilege	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe

description	pid	process	target process
PID 4556 wrote to memory of 2340	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	sihost.exe
PID 4556 wrote to memory of 2356	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	svchost.exe
PID 4556 wrote to memory of 2432	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	taskhostw.exe
PID 4556 wrote to memory of 2800	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	svchost.exe
PID 4556 wrote to memory of 3252	4556	75b37b61fbbd2e474e235398bf9aafe4ee978ba13f24e0e2343a656d705315c1.exe	DllHost.exe

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2800

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2356

memory/2340-131-0x00007FF7DA9D0000-0x00007FF7DAD67000-memory.dmp

Filesize
3.6MB

Download
memory/2356-132-0x00007FF7DA9D0000-0x00007FF7DAD67000-memory.dmp

Filesize
3.6MB

Download