cb1ac37436c7ce42fd6ecb46732e44c632bea6645a51ceba5f4e186688befb6f

Analysis

max time kernel
117s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2022, 13:41

Target
Login failed report.exe
Size 645KB
Sample220811-qy359saag3
SHA256 cb1ac37436c7ce42fd6ecb46732e44c632bea6645a51ceba5f4e186688befb6f
MD5 217ea33be70a1a6f4b9dbb397341c7eb
SHA1 48cf2b114dad13ba2cd5231e0c4bc5cbd9c39eef
SHA512 9ee2fa60d5b34b5f9083d366ca7b226541c4bd94e5c54a09533c17f0f03248389127e59de6962aaf60aa3e32de142bfbc9f99063e23522b0445489d59d775895
MD5 SHA1 SHA512

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	Login failed report.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3120	4092	Login failed report.exe	93
PID 4092 wrote to memory of 3120	4092	Login failed report.exe	93
PID 4092 wrote to memory of 3120	4092	Login failed report.exe	93
PID 4092 wrote to memory of 3920	4092	Login failed report.exe	94
PID 4092 wrote to memory of 3920	4092	Login failed report.exe	94
PID 4092 wrote to memory of 3920	4092	Login failed report.exe	94
PID 4092 wrote to memory of 1760	4092	Login failed report.exe	95
PID 4092 wrote to memory of 1760	4092	Login failed report.exe	95
PID 4092 wrote to memory of 1760	4092	Login failed report.exe	95
PID 4092 wrote to memory of 1120	4092	Login failed report.exe	96
PID 4092 wrote to memory of 1120	4092	Login failed report.exe	96
PID 4092 wrote to memory of 1120	4092	Login failed report.exe	96
PID 4092 wrote to memory of 4412	4092	Login failed report.exe	97
PID 4092 wrote to memory of 4412	4092	Login failed report.exe	97
PID 4092 wrote to memory of 4412	4092	Login failed report.exe	97

C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
"C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:3920
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\Login failed report.exe
  "C:\Users\Admin\AppData\Local\Temp\Login failed report.exe"
  2⤵
  PID:4412

memory/4092-130-0x0000000000DB0000-0x0000000000E58000-memory.dmp

Download

memory/4092-131-0x0000000005F30000-0x00000000064D4000-memory.dmp

Download

memory/4092-132-0x0000000005860000-0x00000000058F2000-memory.dmp

Download

memory/4092-133-0x00000000057F0000-0x00000000057FA000-memory.dmp

Download

memory/4092-134-0x0000000007EA0000-0x0000000007F3C000-memory.dmp

Download

memory/4092-135-0x0000000007F40000-0x0000000007FA6000-memory.dmp

Download