0055c0240aa6da781fdbe57182ebe6d1e69c9d9a1eb401cdab0ad574e9191c17

Analysis

max time kernel
111s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2022, 12:21

Target
PO5674 SPEC DETAILING.exe
Size 420KB
Sample220923-pjbl2aaahp
SHA256 0055c0240aa6da781fdbe57182ebe6d1e69c9d9a1eb401cdab0ad574e9191c17
MD5 76536a6d74aca34be5f1a0ecee089e41
SHA1 cd107616f0c8c0614b8a25e7f81325b8c0c69f82
SHA512 fc61a84f954edf55d538464b71c159c870a8e71cd4737d24c13d2d46af719b142442eeaa328e3e3949e1229fdcf9b6e39b736968997cada022c641a9e682836b
SSDEEP 12288:H9ZNfOVrxTf61ZthNBcHzN+I8clgUGXnPG9d4:CfIhNBozN+IRzG/Gw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	PO5674 SPEC DETAILING.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4088	3972	PO5674 SPEC DETAILING.exe	79
PID 3972 wrote to memory of 4088	3972	PO5674 SPEC DETAILING.exe	79
PID 3972 wrote to memory of 4088	3972	PO5674 SPEC DETAILING.exe	79
PID 3972 wrote to memory of 1864	3972	PO5674 SPEC DETAILING.exe	80
PID 3972 wrote to memory of 1864	3972	PO5674 SPEC DETAILING.exe	80
PID 3972 wrote to memory of 1864	3972	PO5674 SPEC DETAILING.exe	80
PID 3972 wrote to memory of 3716	3972	PO5674 SPEC DETAILING.exe	81
PID 3972 wrote to memory of 3716	3972	PO5674 SPEC DETAILING.exe	81
PID 3972 wrote to memory of 3716	3972	PO5674 SPEC DETAILING.exe	81
PID 3972 wrote to memory of 3052	3972	PO5674 SPEC DETAILING.exe	82
PID 3972 wrote to memory of 3052	3972	PO5674 SPEC DETAILING.exe	82
PID 3972 wrote to memory of 3052	3972	PO5674 SPEC DETAILING.exe	82
PID 3972 wrote to memory of 1804	3972	PO5674 SPEC DETAILING.exe	83
PID 3972 wrote to memory of 1804	3972	PO5674 SPEC DETAILING.exe	83
PID 3972 wrote to memory of 1804	3972	PO5674 SPEC DETAILING.exe	83

C:\Users\Admin\AppData\Local\Temp\PO5674 SPEC DETAILING.exe
"C:\Users\Admin\AppData\Local\Temp\PO5674 SPEC DETAILING.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:1804

memory/3972-132-0x0000000000660000-0x00000000006CA000-memory.dmp

Download