19c514e7d49eeb7c8c045ae797a7d2f2e4a40f7c1c6bbc9166f8ed18b3d330b3

Analysis

Target
bbd2e708b9cb91caf2e86d8ac7e858f7.exe
Size 669KB
Sample220616-gcwdvsgdc3
SHA256 19c514e7d49eeb7c8c045ae797a7d2f2e4a40f7c1c6bbc9166f8ed18b3d330b3
MD5 bbd2e708b9cb91caf2e86d8ac7e858f7
SHA1 3de6e185e136857d0905795c6566bd9d69247f1c
SHA512 8efe511b36cc2e1786935e5d5517f58444a6fc9ac477955cbf7958b743da0847fd3364aec20a96044b6e21d885b5525102596f4113ef23b066d3f478e1ec07e2
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	bbd2e708b9cb91caf2e86d8ac7e858f7.exe
2916	bbd2e708b9cb91caf2e86d8ac7e858f7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	bbd2e708b9cb91caf2e86d8ac7e858f7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4852	2916	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	80
PID 2916 wrote to memory of 4852	2916	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	80
PID 2916 wrote to memory of 4852	2916	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	80
PID 2916 wrote to memory of 4852	2916	bbd2e708b9cb91caf2e86d8ac7e858f7.exe	80

C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe
"C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe
  "C:\Users\Admin\AppData\Local\Temp\bbd2e708b9cb91caf2e86d8ac7e858f7.exe"
  2⤵
  PID:4852

memory/2916-130-0x0000000000E70000-0x0000000000F20000-memory.dmp

Download

memory/2916-131-0x0000000006180000-0x0000000006724000-memory.dmp

Download

memory/2916-132-0x0000000005C70000-0x0000000005D0C000-memory.dmp

Download