a4642bf9cbd641619645c6f4761ef8037b3844e948f588c8bd58e32eed70fb14

Analysis

max time kernel
57s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 07:47

Target

NEW_PO#2220000004.exe
Size

1.3MB
MD5

b1416169a5d9b7deb7e4a131c31c5dc2
SHA1

0c799fbff28138911aec438815601ab372ee4f28
SHA256

a4642bf9cbd641619645c6f4761ef8037b3844e948f588c8bd58e32eed70fb14
SHA512

d71822e649f3232732fb315d65dbfff4b96474f0e34eff4ed2a9c4dd5866164360b79b9afeee13cdac000e23f6d83045e874ebbdee5a85eb1405d03497a34813
SSDEEP

24576:+q8Go19UYpeaJFnrYyaXq/M1ZN916R3lN:+qsUCFnNa6QLnQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	NEW_PO#2220000004.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2020	1660	NEW_PO#2220000004.exe	28
PID 1660 wrote to memory of 2020	1660	NEW_PO#2220000004.exe	28
PID 1660 wrote to memory of 2020	1660	NEW_PO#2220000004.exe	28
PID 1660 wrote to memory of 2020	1660	NEW_PO#2220000004.exe	28
PID 1660 wrote to memory of 2024	1660	NEW_PO#2220000004.exe	29
PID 1660 wrote to memory of 2024	1660	NEW_PO#2220000004.exe	29
PID 1660 wrote to memory of 2024	1660	NEW_PO#2220000004.exe	29
PID 1660 wrote to memory of 2024	1660	NEW_PO#2220000004.exe	29
PID 1660 wrote to memory of 2040	1660	NEW_PO#2220000004.exe	30
PID 1660 wrote to memory of 2040	1660	NEW_PO#2220000004.exe	30
PID 1660 wrote to memory of 2040	1660	NEW_PO#2220000004.exe	30
PID 1660 wrote to memory of 2040	1660	NEW_PO#2220000004.exe	30
PID 1660 wrote to memory of 2044	1660	NEW_PO#2220000004.exe	31
PID 1660 wrote to memory of 2044	1660	NEW_PO#2220000004.exe	31
PID 1660 wrote to memory of 2044	1660	NEW_PO#2220000004.exe	31
PID 1660 wrote to memory of 2044	1660	NEW_PO#2220000004.exe	31
PID 1660 wrote to memory of 1728	1660	NEW_PO#2220000004.exe	32
PID 1660 wrote to memory of 1728	1660	NEW_PO#2220000004.exe	32
PID 1660 wrote to memory of 1728	1660	NEW_PO#2220000004.exe	32
PID 1660 wrote to memory of 1728	1660	NEW_PO#2220000004.exe	32

C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe
"C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe"
  2⤵
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe"
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe"
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe"
  2⤵
  PID:2044
- C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW_PO#2220000004.exe"
  2⤵
  PID:1728

memory/1660-54-0x00000000002D0000-0x000000000041C000-memory.dmp

Filesize
1.3MB

Download
memory/1660-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1660-56-0x00000000004B0000-0x00000000004C4000-memory.dmp

Filesize
80KB

Download
memory/1660-57-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/1660-58-0x0000000007EA0000-0x0000000007F5E000-memory.dmp

Filesize
760KB

Download
memory/1660-59-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Filesize
408KB

Download