Analysis
-
max time kernel
44s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:19
Static task
static1
Behavioral task
behavioral1
Sample
a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe
-
Size
900KB
-
MD5
a478a037c8f7c793d33d1e0c98b872a8
-
SHA1
4c650cdd020027dd7384104343a70bd5c16e88dd
-
SHA256
a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7
-
SHA512
ed81a9b6789ea9da207a5a1e27a1c7d789ec7b82cdfe1a4454577f29f5b7350ec6592b02bd224240ead0d5d7dd686c2da3e8d463eff8c310f53b6c9dbb7eb105
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exepid process 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exedescription pid process Token: SeDebugPrivilege 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exedescription pid process target process PID 756 wrote to memory of 2036 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2036 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2036 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2036 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1204 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1204 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1204 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1204 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1904 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1904 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1904 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 1904 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2004 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2004 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2004 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2004 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2012 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2012 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2012 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe PID 756 wrote to memory of 2012 756 a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe"C:\Users\Admin\AppData\Local\Temp\a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a9f274b0b3283ecccdb07bb89bfe1af9ead7d8d766b89e5f05122c78c21173e7.exe"{path}"2⤵