af0b80a22d6bcdd0fe11bb5566784684087b92f1eefd51f323656cfbf27e31c4

Analysis

max time kernel
45s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/09/2022, 10:39

Target
230fda7e30a41eb69135d6ae764c97ad.exe
Size 816KB
Sample220929-mpymmsbeek
SHA256 af0b80a22d6bcdd0fe11bb5566784684087b92f1eefd51f323656cfbf27e31c4
MD5 230fda7e30a41eb69135d6ae764c97ad
SHA1 274ec8c345a001ef553b97d0b20add2ec7b6c62c
SHA512 8ad3539f65bff816905be7e2892799464abe62e923206d0a0fba332a6a46953af8240b8a555c0fa1d879b0127dd84a6d367cda16369b2e4610342c176f3dcd28
SSDEEP 12288:4An2iNoHFoawdZwR7obtuExuZ9PtWAqfqppLMyKEoKoMNppkTJRgf:91/pZwR7Qm3Y1fjEDjQ38
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	240	230fda7e30a41eb69135d6ae764c97ad.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1320	240	230fda7e30a41eb69135d6ae764c97ad.exe	28
PID 240 wrote to memory of 1320	240	230fda7e30a41eb69135d6ae764c97ad.exe	28
PID 240 wrote to memory of 1320	240	230fda7e30a41eb69135d6ae764c97ad.exe	28
PID 240 wrote to memory of 1320	240	230fda7e30a41eb69135d6ae764c97ad.exe	28
PID 240 wrote to memory of 1280	240	230fda7e30a41eb69135d6ae764c97ad.exe	29
PID 240 wrote to memory of 1280	240	230fda7e30a41eb69135d6ae764c97ad.exe	29
PID 240 wrote to memory of 1280	240	230fda7e30a41eb69135d6ae764c97ad.exe	29
PID 240 wrote to memory of 1280	240	230fda7e30a41eb69135d6ae764c97ad.exe	29
PID 240 wrote to memory of 1136	240	230fda7e30a41eb69135d6ae764c97ad.exe	30
PID 240 wrote to memory of 1136	240	230fda7e30a41eb69135d6ae764c97ad.exe	30
PID 240 wrote to memory of 1136	240	230fda7e30a41eb69135d6ae764c97ad.exe	30
PID 240 wrote to memory of 1136	240	230fda7e30a41eb69135d6ae764c97ad.exe	30
PID 240 wrote to memory of 1084	240	230fda7e30a41eb69135d6ae764c97ad.exe	31
PID 240 wrote to memory of 1084	240	230fda7e30a41eb69135d6ae764c97ad.exe	31
PID 240 wrote to memory of 1084	240	230fda7e30a41eb69135d6ae764c97ad.exe	31
PID 240 wrote to memory of 1084	240	230fda7e30a41eb69135d6ae764c97ad.exe	31
PID 240 wrote to memory of 1972	240	230fda7e30a41eb69135d6ae764c97ad.exe	32
PID 240 wrote to memory of 1972	240	230fda7e30a41eb69135d6ae764c97ad.exe	32
PID 240 wrote to memory of 1972	240	230fda7e30a41eb69135d6ae764c97ad.exe	32
PID 240 wrote to memory of 1972	240	230fda7e30a41eb69135d6ae764c97ad.exe	32

C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe
"C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe
  "C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe"
  2⤵
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe
  "C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe"
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe
  "C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe"
  2⤵
  PID:1136
- C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe
  "C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe"
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe
  "C:\Users\Admin\AppData\Local\Temp\230fda7e30a41eb69135d6ae764c97ad.exe"
  2⤵
  PID:1972

memory/240-54-0x00000000003B0000-0x0000000000482000-memory.dmp

Download

memory/240-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Download

memory/240-56-0x0000000000270000-0x0000000000284000-memory.dmp

Download

memory/240-57-0x00000000003A0000-0x00000000003B4000-memory.dmp

Download

memory/240-58-0x0000000000500000-0x000000000050C000-memory.dmp

Download

memory/240-59-0x0000000007FA0000-0x0000000008034000-memory.dmp

Download

memory/240-60-0x0000000002040000-0x000000000207A000-memory.dmp

Download