346277a4a4b0582ad1e74421617c8d1c33708c0a3803ff2b56ab7bc3af0d7c53

Analysis

max time kernel
64s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-08-2022 15:23

Target

jVmDUI3M4mLH141.exe
Size

924KB
MD5

6b2874b71838bb35b1bbf5394322cf2a
SHA1

e9f112a2cd8af4359d3833c59421b89dde2f52dd
SHA256

346277a4a4b0582ad1e74421617c8d1c33708c0a3803ff2b56ab7bc3af0d7c53
SHA512

4c315bbc83e1bc418d3bbbc6212a0c42d4aa4b73b4bf8c9f9bc7244b7fc833c5baa105b5c983383720cd04b415fa07d881857daf4efce028c21f947b8ecd261b
SSDEEP

12288:sjVF75eQyMCHA4bPgkgPwqoXYkCkgrQlU2h3Wqzqqj3rZ8D8R/7pkqIwpq:kZ50MEZXYkCTQlU2VWqz9NWA/7R0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	jVmDUI3M4mLH141.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 828	1976	jVmDUI3M4mLH141.exe	26
PID 1976 wrote to memory of 828	1976	jVmDUI3M4mLH141.exe	26
PID 1976 wrote to memory of 828	1976	jVmDUI3M4mLH141.exe	26
PID 1976 wrote to memory of 828	1976	jVmDUI3M4mLH141.exe	26
PID 1976 wrote to memory of 1180	1976	jVmDUI3M4mLH141.exe	27
PID 1976 wrote to memory of 1180	1976	jVmDUI3M4mLH141.exe	27
PID 1976 wrote to memory of 1180	1976	jVmDUI3M4mLH141.exe	27
PID 1976 wrote to memory of 1180	1976	jVmDUI3M4mLH141.exe	27
PID 1976 wrote to memory of 1136	1976	jVmDUI3M4mLH141.exe	28
PID 1976 wrote to memory of 1136	1976	jVmDUI3M4mLH141.exe	28
PID 1976 wrote to memory of 1136	1976	jVmDUI3M4mLH141.exe	28
PID 1976 wrote to memory of 1136	1976	jVmDUI3M4mLH141.exe	28
PID 1976 wrote to memory of 1296	1976	jVmDUI3M4mLH141.exe	29
PID 1976 wrote to memory of 1296	1976	jVmDUI3M4mLH141.exe	29
PID 1976 wrote to memory of 1296	1976	jVmDUI3M4mLH141.exe	29
PID 1976 wrote to memory of 1296	1976	jVmDUI3M4mLH141.exe	29
PID 1976 wrote to memory of 1272	1976	jVmDUI3M4mLH141.exe	30
PID 1976 wrote to memory of 1272	1976	jVmDUI3M4mLH141.exe	30
PID 1976 wrote to memory of 1272	1976	jVmDUI3M4mLH141.exe	30
PID 1976 wrote to memory of 1272	1976	jVmDUI3M4mLH141.exe	30

C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe
"C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe
  "C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe"
  2⤵
  PID:828
- C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe
  "C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe"
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe
  "C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe"
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe
  "C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe"
  2⤵
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe
  "C:\Users\Admin\AppData\Local\Temp\jVmDUI3M4mLH141.exe"
  2⤵
  PID:1272

memory/1976-54-0x0000000000360000-0x000000000044E000-memory.dmp

Filesize
952KB

Download
memory/1976-55-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/1976-57-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/1976-58-0x0000000005D40000-0x0000000005DC6000-memory.dmp

Filesize
536KB

Download
memory/1976-59-0x0000000001F60000-0x0000000001F90000-memory.dmp

Filesize
192KB

Download