2e55e2c67fa00e3e955098409e3ee4037367af854f657cbbc83d5931b4355c36

General

Target
38bb52be5f33531c14022cc2d6c124d5.exe
Size 650KB
Sample220512-c3kmtsbcbk
SHA256 2e55e2c67fa00e3e955098409e3ee4037367af854f657cbbc83d5931b4355c36
MD5 38bb52be5f33531c14022cc2d6c124d5
SHA1 cd85339b1c2f4ef2e9267a5ccbba144b3673329c
SHA512 e983b7a718b69fbe23dedee7f7223d5f273cb0d2b445c19359f0ab8ebbfcb01ebef1dc980e70c2c906860a5a599ad4e825357b43e83f1472806bc06a0e247b6f
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	38bb52be5f33531c14022cc2d6c124d5.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1140	912	38bb52be5f33531c14022cc2d6c124d5.exe	27
PID 912 wrote to memory of 1140	912	38bb52be5f33531c14022cc2d6c124d5.exe	27
PID 912 wrote to memory of 1140	912	38bb52be5f33531c14022cc2d6c124d5.exe	27
PID 912 wrote to memory of 1140	912	38bb52be5f33531c14022cc2d6c124d5.exe	27
PID 912 wrote to memory of 1252	912	38bb52be5f33531c14022cc2d6c124d5.exe	28
PID 912 wrote to memory of 1252	912	38bb52be5f33531c14022cc2d6c124d5.exe	28
PID 912 wrote to memory of 1252	912	38bb52be5f33531c14022cc2d6c124d5.exe	28
PID 912 wrote to memory of 1252	912	38bb52be5f33531c14022cc2d6c124d5.exe	28
PID 912 wrote to memory of 632	912	38bb52be5f33531c14022cc2d6c124d5.exe	29
PID 912 wrote to memory of 632	912	38bb52be5f33531c14022cc2d6c124d5.exe	29
PID 912 wrote to memory of 632	912	38bb52be5f33531c14022cc2d6c124d5.exe	29
PID 912 wrote to memory of 632	912	38bb52be5f33531c14022cc2d6c124d5.exe	29
PID 912 wrote to memory of 1764	912	38bb52be5f33531c14022cc2d6c124d5.exe	30
PID 912 wrote to memory of 1764	912	38bb52be5f33531c14022cc2d6c124d5.exe	30
PID 912 wrote to memory of 1764	912	38bb52be5f33531c14022cc2d6c124d5.exe	30
PID 912 wrote to memory of 1764	912	38bb52be5f33531c14022cc2d6c124d5.exe	30
PID 912 wrote to memory of 828	912	38bb52be5f33531c14022cc2d6c124d5.exe	31
PID 912 wrote to memory of 828	912	38bb52be5f33531c14022cc2d6c124d5.exe	31
PID 912 wrote to memory of 828	912	38bb52be5f33531c14022cc2d6c124d5.exe	31
PID 912 wrote to memory of 828	912	38bb52be5f33531c14022cc2d6c124d5.exe	31

C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe
"C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe
  "C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe"
  2⤵
  PID:1140
- C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe
  "C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe"
  2⤵
  PID:1252
- C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe
  "C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe"
  2⤵
  PID:632
- C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe
  "C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe"
  2⤵
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe
  "C:\Users\Admin\AppData\Local\Temp\38bb52be5f33531c14022cc2d6c124d5.exe"
  2⤵
  PID:828

memory/912-54-0x00000000003E0000-0x0000000000488000-memory.dmp

Download

memory/912-55-0x0000000075C71000-0x0000000075C73000-memory.dmp

Download

memory/912-56-0x00000000004A0000-0x00000000004A8000-memory.dmp

Download

memory/912-57-0x0000000005560000-0x00000000055EE000-memory.dmp

Download

memory/912-58-0x0000000000690000-0x00000000006CE000-memory.dmp

Download