dcc2581e7d573e4a33a8e8edfe740f7b74c54fdfe12531ef1c5a8e13abd89e87

Analysis

Target
Reliable Supplies.exe
Size 548KB
Sample220331-apf2dabef5
SHA256 dcc2581e7d573e4a33a8e8edfe740f7b74c54fdfe12531ef1c5a8e13abd89e87
MD5 bcf0e9c65bd8a3e8516ff0182a899914
SHA1 d5338150b4eb4918345fa24b5beb15ffe06cf6c1
SHA512 21ea70392c6f0e9e72dc610987c96d6740dec68984c28bc69c80518755950ee74d90962d1c0bde300e41d18e93b4d6af4fa6600f92a38e6a931cc2770bcfff8d
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	Reliable Supplies.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 880	968	Reliable Supplies.exe	29
PID 968 wrote to memory of 880	968	Reliable Supplies.exe	29
PID 968 wrote to memory of 880	968	Reliable Supplies.exe	29
PID 968 wrote to memory of 880	968	Reliable Supplies.exe	29
PID 968 wrote to memory of 1896	968	Reliable Supplies.exe	30
PID 968 wrote to memory of 1896	968	Reliable Supplies.exe	30
PID 968 wrote to memory of 1896	968	Reliable Supplies.exe	30
PID 968 wrote to memory of 1896	968	Reliable Supplies.exe	30
PID 968 wrote to memory of 1988	968	Reliable Supplies.exe	31
PID 968 wrote to memory of 1988	968	Reliable Supplies.exe	31
PID 968 wrote to memory of 1988	968	Reliable Supplies.exe	31
PID 968 wrote to memory of 1988	968	Reliable Supplies.exe	31
PID 968 wrote to memory of 820	968	Reliable Supplies.exe	32
PID 968 wrote to memory of 820	968	Reliable Supplies.exe	32
PID 968 wrote to memory of 820	968	Reliable Supplies.exe	32
PID 968 wrote to memory of 820	968	Reliable Supplies.exe	32
PID 968 wrote to memory of 1892	968	Reliable Supplies.exe	33
PID 968 wrote to memory of 1892	968	Reliable Supplies.exe	33
PID 968 wrote to memory of 1892	968	Reliable Supplies.exe	33
PID 968 wrote to memory of 1892	968	Reliable Supplies.exe	33

C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe
"C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe
  "C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"
  2⤵
  PID:880
- C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe
  "C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"
  2⤵
  PID:1896
- C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe
  "C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"
  2⤵
  PID:1988
- C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe
  "C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"
  2⤵
  PID:820
- C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe
  "C:\Users\Admin\AppData\Local\Temp\Reliable Supplies.exe"
  2⤵
  PID:1892

memory/968-54-0x00000000003E0000-0x000000000046E000-memory.dmp

Download

memory/968-55-0x00000000004F0000-0x00000000004FA000-memory.dmp

Download

memory/968-56-0x00000000056F0000-0x0000000005768000-memory.dmp

Download

memory/968-57-0x0000000002040000-0x0000000002074000-memory.dmp

Download