36c9af5b5712f266baac8963ca365fa3d3b40f8ef1cbfdd4784612d4685d3cc5

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
13-10-2022 13:02

Target

Specification.exe
Size

1.4MB
MD5

75c4f755670d62947bf2dabb7857165c
SHA1

a86c8680456b8e12ea0e6f5c29622191064b9c6a
SHA256

36c9af5b5712f266baac8963ca365fa3d3b40f8ef1cbfdd4784612d4685d3cc5
SHA512

3f8dbedfb5f29810ef9be65f479afecd18c8d62d5a930dd099f3224425adc29b6f601a88ea3d6f3f81ec37b72788495665a2c6375378da688d33fb44a4160022
SSDEEP

24576:44oTw9wQsp66R9MFPALm68hFYQdAIzQkkZbL0NOzfiUMmdB:l9KpDRsAiTDZcZAefiUMm

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	Specification.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 812	1268	Specification.exe	27
PID 1268 wrote to memory of 812	1268	Specification.exe	27
PID 1268 wrote to memory of 812	1268	Specification.exe	27
PID 1268 wrote to memory of 812	1268	Specification.exe	27
PID 1268 wrote to memory of 848	1268	Specification.exe	28
PID 1268 wrote to memory of 848	1268	Specification.exe	28
PID 1268 wrote to memory of 848	1268	Specification.exe	28
PID 1268 wrote to memory of 848	1268	Specification.exe	28
PID 1268 wrote to memory of 1116	1268	Specification.exe	29
PID 1268 wrote to memory of 1116	1268	Specification.exe	29
PID 1268 wrote to memory of 1116	1268	Specification.exe	29
PID 1268 wrote to memory of 1116	1268	Specification.exe	29
PID 1268 wrote to memory of 1064	1268	Specification.exe	30
PID 1268 wrote to memory of 1064	1268	Specification.exe	30
PID 1268 wrote to memory of 1064	1268	Specification.exe	30
PID 1268 wrote to memory of 1064	1268	Specification.exe	30
PID 1268 wrote to memory of 1528	1268	Specification.exe	31
PID 1268 wrote to memory of 1528	1268	Specification.exe	31
PID 1268 wrote to memory of 1528	1268	Specification.exe	31
PID 1268 wrote to memory of 1528	1268	Specification.exe	31

C:\Users\Admin\AppData\Local\Temp\Specification.exe
"C:\Users\Admin\AppData\Local\Temp\Specification.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Specification.exe"
  2⤵
  PID:812
- C:\Users\Admin\AppData\Local\Temp\Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Specification.exe"
  2⤵
  PID:848
- C:\Users\Admin\AppData\Local\Temp\Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Specification.exe"
  2⤵
  PID:1116
- C:\Users\Admin\AppData\Local\Temp\Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Specification.exe"
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Local\Temp\Specification.exe
  "C:\Users\Admin\AppData\Local\Temp\Specification.exe"
  2⤵
  PID:1528

memory/1268-54-0x00000000003A0000-0x000000000050C000-memory.dmp

Filesize
1.4MB

Download
memory/1268-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1268-56-0x0000000000790000-0x00000000007AA000-memory.dmp

Filesize
104KB

Download
memory/1268-57-0x0000000002040000-0x000000000204C000-memory.dmp

Filesize
48KB

Download
memory/1268-58-0x000000000A6F0000-0x000000000A7F8000-memory.dmp

Filesize
1.0MB

Download
memory/1268-59-0x0000000005BB0000-0x0000000005C64000-memory.dmp

Filesize
720KB

Download