17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

Analysis

Target

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
Size

840KB
MD5

8a2123d4809ffdc677df37b88d58769c
SHA1

4138f2da78ccf7ed3a07d455fddb367f59568d04
SHA256

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80
SHA512

632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

pid	process
1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

description pid process

Token: SeDebugPrivilege 1640 17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

description	pid	process
Token: SeDebugPrivilege	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe

description	pid	process	target process
PID 1640 wrote to memory of 364	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1640 wrote to memory of 364	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1640 wrote to memory of 364	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1640 wrote to memory of 364	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1640 wrote to memory of 364	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1640 wrote to memory of 364	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe
PID 1640 wrote to memory of 364	1640	17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe
"C:\Users\Admin\AppData\Local\Temp\17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:364

memory/1640-54-0x0000000001300000-0x00000000013D8000-memory.dmp

Filesize
864KB

Download
memory/1640-55-0x0000000000980000-0x0000000000998000-memory.dmp

Filesize
96KB

Download