cb1ac37436c7ce42fd6ecb46732e44c632bea6645a51ceba5f4e186688befb6f

Analysis

max time kernel
59s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
11/08/2022, 13:41

Target
Login failed report.exe
Size 645KB
Sample220811-qy359saag3
SHA256 cb1ac37436c7ce42fd6ecb46732e44c632bea6645a51ceba5f4e186688befb6f
MD5 217ea33be70a1a6f4b9dbb397341c7eb
SHA1 48cf2b114dad13ba2cd5231e0c4bc5cbd9c39eef
SHA512 9ee2fa60d5b34b5f9083d366ca7b226541c4bd94e5c54a09533c17f0f03248389127e59de6962aaf60aa3e32de142bfbc9f99063e23522b0445489d59d775895
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	Login failed report.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1776	912	Login failed report.exe	27
PID 912 wrote to memory of 1776	912	Login failed report.exe	27
PID 912 wrote to memory of 1776	912	Login failed report.exe	27
PID 912 wrote to memory of 1776	912	Login failed report.exe	27
PID 912 wrote to memory of 1744	912	Login failed report.exe	28
PID 912 wrote to memory of 1744	912	Login failed report.exe	28
PID 912 wrote to memory of 1744	912	Login failed report.exe	28
PID 912 wrote to memory of 1744	912	Login failed report.exe	28
PID 912 wrote to memory of 316	912	Login failed report.exe	29
PID 912 wrote to memory of 316	912	Login failed report.exe	29
PID 912 wrote to memory of 316	912	Login failed report.exe	29
PID 912 wrote to memory of 316	912	Login failed report.exe	29
PID 912 wrote to memory of 1540	912	Login failed report.exe	30
PID 912 wrote to memory of 1540	912	Login failed report.exe	30
PID 912 wrote to memory of 1540	912	Login failed report.exe	30
PID 912 wrote to memory of 1540	912	Login failed report.exe	30
PID 912 wrote to memory of 1572	912	Login failed report.exe	31
PID 912 wrote to memory of 1572	912	Login failed report.exe	31
PID 912 wrote to memory of 1572	912	Login failed report.exe	31
PID 912 wrote to memory of 1572	912	Login failed report.exe	31

C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
"C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:1572

memory/912-54-0x0000000001220000-0x00000000012C8000-memory.dmp

Download

memory/912-55-0x0000000076A21000-0x0000000076A23000-memory.dmp

Download

memory/912-56-0x0000000000420000-0x0000000000444000-memory.dmp

Download

memory/912-57-0x0000000000450000-0x000000000045C000-memory.dmp

Download

memory/912-58-0x0000000004970000-0x00000000049B8000-memory.dmp

Download

memory/912-59-0x0000000000AA0000-0x0000000000AA8000-memory.dmp

Download