e6c7afab3a42bacbcf55bd612eb12391211274286afb6da268245026853360ec

Analysis

max time kernel
50s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
28/07/2022, 07:36

Target

NEW RFQ #9832.exe
Size

1.4MB
MD5

36ac92d9688f346f745fd772be95bc62
SHA1

7ca0a109657ede839dc86a2d6644d9345fe4a504
SHA256

e6c7afab3a42bacbcf55bd612eb12391211274286afb6da268245026853360ec
SHA512

f07b7506763749d1647e3186a8cc77317f7bba8bdb6b8cb6c9f8ec459617c5dd413efbd09aa1cf1f42a7c0392889e9203320aca0f92006024ada551ad8c4a570

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	NEW RFQ #9832.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1096	1704	NEW RFQ #9832.exe	27
PID 1704 wrote to memory of 1096	1704	NEW RFQ #9832.exe	27
PID 1704 wrote to memory of 1096	1704	NEW RFQ #9832.exe	27
PID 1704 wrote to memory of 1096	1704	NEW RFQ #9832.exe	27
PID 1704 wrote to memory of 844	1704	NEW RFQ #9832.exe	28
PID 1704 wrote to memory of 844	1704	NEW RFQ #9832.exe	28
PID 1704 wrote to memory of 844	1704	NEW RFQ #9832.exe	28
PID 1704 wrote to memory of 844	1704	NEW RFQ #9832.exe	28
PID 1704 wrote to memory of 816	1704	NEW RFQ #9832.exe	29
PID 1704 wrote to memory of 816	1704	NEW RFQ #9832.exe	29
PID 1704 wrote to memory of 816	1704	NEW RFQ #9832.exe	29
PID 1704 wrote to memory of 816	1704	NEW RFQ #9832.exe	29
PID 1704 wrote to memory of 1452	1704	NEW RFQ #9832.exe	30
PID 1704 wrote to memory of 1452	1704	NEW RFQ #9832.exe	30
PID 1704 wrote to memory of 1452	1704	NEW RFQ #9832.exe	30
PID 1704 wrote to memory of 1452	1704	NEW RFQ #9832.exe	30
PID 1704 wrote to memory of 1112	1704	NEW RFQ #9832.exe	31
PID 1704 wrote to memory of 1112	1704	NEW RFQ #9832.exe	31
PID 1704 wrote to memory of 1112	1704	NEW RFQ #9832.exe	31
PID 1704 wrote to memory of 1112	1704	NEW RFQ #9832.exe	31

C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe
"C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe"
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe"
  2⤵
  PID:844
- C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe"
  2⤵
  PID:816
- C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe"
  2⤵
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW RFQ #9832.exe"
  2⤵
  PID:1112

memory/1704-54-0x00000000002D0000-0x0000000000430000-memory.dmp

Filesize
1.4MB

Download
memory/1704-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1704-56-0x0000000000710000-0x0000000000726000-memory.dmp

Filesize
88KB

Download
memory/1704-57-0x0000000000950000-0x000000000095A000-memory.dmp

Filesize
40KB

Download
memory/1704-58-0x000000000A5B0000-0x000000000A69E000-memory.dmp

Filesize
952KB

Download
memory/1704-59-0x000000000A6A0000-0x000000000A746000-memory.dmp

Filesize
664KB

Download