d18530899d9bdaf56500f6db6c64e34313d4d9997ea7a4530c0b131efe002dbb

Analysis

max time kernel
46s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-10-2022 06:43

Target

RFQ#00092022.exe
Size

1.4MB
MD5

42f4a19dc81367621d2a28f4da0f746e
SHA1

18aea8f955e12adafeae521bf2aca33c400d8820
SHA256

363eadd86b68060f7b436c585757a0356bbf6dc000d125612e9cd42cb3819b72
SHA512

dd9da22085484537fa1d2a5b3467a6b2935cc51cd5ff5719799476f494b106485a039df427a653de05486084c354b7c0e7d6519330131b439692db5b8fa267b3
SSDEEP

24576:YiFulLrYjqEz7YdaCkCCI0S2ll1subE7qxo3i:YisIjqEz7vfS2CRqe3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	RFQ#00092022.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	RFQ#00092022.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1088	RFQ#00092022.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 2028	1088	RFQ#00092022.exe	28
PID 1088 wrote to memory of 2028	1088	RFQ#00092022.exe	28
PID 1088 wrote to memory of 2028	1088	RFQ#00092022.exe	28
PID 1088 wrote to memory of 2028	1088	RFQ#00092022.exe	28
PID 1088 wrote to memory of 2032	1088	RFQ#00092022.exe	29
PID 1088 wrote to memory of 2032	1088	RFQ#00092022.exe	29
PID 1088 wrote to memory of 2032	1088	RFQ#00092022.exe	29
PID 1088 wrote to memory of 2032	1088	RFQ#00092022.exe	29
PID 1088 wrote to memory of 1748	1088	RFQ#00092022.exe	30
PID 1088 wrote to memory of 1748	1088	RFQ#00092022.exe	30
PID 1088 wrote to memory of 1748	1088	RFQ#00092022.exe	30
PID 1088 wrote to memory of 1748	1088	RFQ#00092022.exe	30
PID 1088 wrote to memory of 1732	1088	RFQ#00092022.exe	31
PID 1088 wrote to memory of 1732	1088	RFQ#00092022.exe	31
PID 1088 wrote to memory of 1732	1088	RFQ#00092022.exe	31
PID 1088 wrote to memory of 1732	1088	RFQ#00092022.exe	31
PID 1088 wrote to memory of 1996	1088	RFQ#00092022.exe	32
PID 1088 wrote to memory of 1996	1088	RFQ#00092022.exe	32
PID 1088 wrote to memory of 1996	1088	RFQ#00092022.exe	32
PID 1088 wrote to memory of 1996	1088	RFQ#00092022.exe	32

C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe"
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe"
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe"
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe"
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ#00092022.exe"
  2⤵
  PID:1996

memory/1088-54-0x0000000000320000-0x0000000000484000-memory.dmp

Filesize
1.4MB

Download
memory/1088-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1088-56-0x0000000001F30000-0x0000000001F4C000-memory.dmp

Filesize
112KB

Download
memory/1088-57-0x0000000004D25000-0x0000000004D36000-memory.dmp

Filesize
68KB

Download
memory/1088-58-0x0000000001F60000-0x0000000001F6C000-memory.dmp

Filesize
48KB

Download
memory/1088-59-0x0000000008160000-0x000000000826C000-memory.dmp

Filesize
1.0MB

Download
memory/1088-60-0x0000000008270000-0x0000000008328000-memory.dmp

Filesize
736KB

Download
memory/1088-61-0x0000000004D25000-0x0000000004D36000-memory.dmp

Filesize
68KB

Download