ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 11:41

Target

ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe
Size

114KB
MD5

75aa766100cc00a023da88329c7792d9
SHA1

6b09bf4ad151316312e3ea1ca6496da85bf2db35
SHA256

ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097
SHA512

de570df22cc6356bc7e47dc14ff3f44046df6c68cc0f333227332bae63d875539d6af11021432c383de6e45470190bf0a96e22d9f48bdacdf6f789243a3f2957
SSDEEP

1536:nIe/0V+dTagDoFdcokBmzJEjr10OJl+kJLcNg38r0G3EtLKJZsn867QJlSEEwNVv:Ie/0VQagDojEBn1KktY3EFKkcJAxY

Score

7^/10

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2248	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2248	2072	ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2248
- C:\Users\Admin\AppData\Local\Temp\ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe
  "C:\Users\Admin\AppData\Local\Temp\ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2072