19c514e7d49eeb7c8c045ae797a7d2f2e4a40f7c1c6bbc9166f8ed18b3d330b3

Analysis

Target
bbd2e708b9cb91caf2e86d8ac7e858f7.exe
Size 669KB
Sample220616-gcwdvsgdc3
SHA256 19c514e7d49eeb7c8c045ae797a7d2f2e4a40f7c1c6bbc9166f8ed18b3d330b3
MD5 bbd2e708b9cb91caf2e86d8ac7e858f7
SHA1 3de6e185e136857d0905795c6566bd9d69247f1c
SHA512 8efe511b36cc2e1786935e5d5517f58444a6fc9ac477955cbf7958b743da0847fd3364aec20a96044b6e21d885b5525102596f4113ef23b066d3f478e1ec07e2
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	bbd2e708b9cb91caf2e86d8ac7e858f7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	bbd2e708b9cb91caf2e86d8ac7e858f7.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 852	1936	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	28
PID 1936 wrote to memory of 852	1936	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	28
PID 1936 wrote to memory of 852	1936	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	28
PID 1936 wrote to memory of 852	1936	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	28
PID 1936 wrote to memory of 852	1936	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	28

C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe
"C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe
  "C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe"
  2⤵
  PID:852

memory/852-56-0x0000000000260000-0x00000000002DA000-memory.dmp

Download

memory/1936-54-0x0000000001390000-0x0000000001440000-memory.dmp

Download

memory/1936-55-0x00000000004C0000-0x00000000004DC000-memory.dmp

Download