1aebe5d59997e78b81ad714be8dfd697665381018041c62a40a55f0ce215ea35

Analysis

max time kernel
51s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-10-2022 08:21

Target

6789018157.exe
Size

832KB
MD5

728fdbe7cf7587f807cb2a769a776ef9
SHA1

b10f88f9495b990aa7aa7a9f4856e89f3f7061b4
SHA256

1aebe5d59997e78b81ad714be8dfd697665381018041c62a40a55f0ce215ea35
SHA512

9dbf58336e6e885e4d19d42eed1b3b87fd61d3eb78907d35e7384eabe7ed4c5dd88a1ca811e92ad1b0d36c21977f57dd4c8371ff6585407fb1d1d37cf4c5d25a
SSDEEP

12288:xPKR/4veD8lpIoYQMVa1kUCwYZ7HmIYiDnbVRgn6LyM40M3i:lw4veQGou+AVjDBRgniyeM3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

6789018157.exe

pid process

1348 6789018157.exe
1348 6789018157.exe
1348 6789018157.exe
1348 6789018157.exe
1348 6789018157.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6789018157.exe

description pid process

Token: SeDebugPrivilege 1348 6789018157.exe

description	pid	process
Token: SeDebugPrivilege	1348	6789018157.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

6789018157.exe

description	pid	process	target process
PID 1348 wrote to memory of 1280	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1280	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1280	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1280	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1944	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1944	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1944	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1944	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1788	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1788	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1788	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 1788	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 780	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 780	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 780	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 780	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 736	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 736	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 736	1348	6789018157.exe	6789018157.exe
PID 1348 wrote to memory of 736	1348	6789018157.exe	6789018157.exe

C:\Users\Admin\AppData\Local\Temp\6789018157.exe
"C:\Users\Admin\AppData\Local\Temp\6789018157.exe"
2⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\6789018157.exe
"C:\Users\Admin\AppData\Local\Temp\6789018157.exe"
2⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\6789018157.exe
"C:\Users\Admin\AppData\Local\Temp\6789018157.exe"
2⤵
PID:1788

C:\Users\Admin\AppData\Local\Temp\6789018157.exe
"C:\Users\Admin\AppData\Local\Temp\6789018157.exe"
2⤵
PID:780

C:\Users\Admin\AppData\Local\Temp\6789018157.exe
"C:\Users\Admin\AppData\Local\Temp\6789018157.exe"
2⤵
PID:736

memory/1348-54-0x00000000003F0000-0x00000000004C0000-memory.dmp

Filesize
832KB

Download
memory/1348-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1348-56-0x0000000002160000-0x000000000217C000-memory.dmp

Filesize
112KB

Download
memory/1348-57-0x00000000005E0000-0x00000000005EC000-memory.dmp

Filesize
48KB

Download
memory/1348-58-0x0000000005C50000-0x0000000005CCA000-memory.dmp

Filesize
488KB

Download
memory/1348-59-0x0000000004960000-0x0000000004980000-memory.dmp

Filesize
128KB

Download