8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 18:02

Target

8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
Size

26KB
MD5

76fe49cc6a852f6a5ba7a9609bee4390
SHA1

f0c6e69306573e2ddeabb58c78b46c4bb5938f4f
SHA256

8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9
SHA512

32ad80ff3b198c6c32d329970812de32aed2d9b4b43f42100dab2b489212a1c2946659b28812fc7deef59c2557e8e0bc081978b44c2369228535b4f001c0278b
SSDEEP

384:uDDXZTCW7Y66mWGvrnsV8HpSLTjqiOl6b71qf8gOvRT88k/7/JQsBWwlwVC:UZGoY66mWGTsKUvjKl6c0/nkjHt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1252	svchost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1252	1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe	27
PID 1768 wrote to memory of 1252	1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe	27
PID 1768 wrote to memory of 1252	1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe	27
PID 1768 wrote to memory of 1252	1768	8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe	27

C:\Users\Admin\AppData\Local\Temp\8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe
"C:\Users\Admin\AppData\Local\Temp\8de8f77fd48cc640584bc850479f18eb56fb78841750eadac7c8d27f189b0eb9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  - Deletes itself
  PID:1252

memory/1252-55-0x0000000000000000-mapping.dmp

Download
memory/1252-57-0x00000000007A0000-0x00000000007A8000-memory.dmp

Filesize
32KB

Download
memory/1252-58-0x00000000000C0000-0x00000000000CA000-memory.dmp

Filesize
40KB

Download
memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1768-59-0x0000000001EE0000-0x0000000002EE0000-memory.dmp

Filesize
16.0MB

Download