86b69e37fb4f94c2b24904bbb004474b8f57abecc6332ff595c1eacc7ab59bf6

Analysis

max time kernel
45s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
17/10/2022, 06:30

Target
PO_PT089110.exe
Size 801KB
Sample221017-g9gxqsagg7
SHA256 86b69e37fb4f94c2b24904bbb004474b8f57abecc6332ff595c1eacc7ab59bf6
MD5 2a3eb8a59a40ff2bfb4fa812c2ef6e72
SHA1 1d9e724d345107cd210db376597d941bd7ec12a2
SHA512 0a857e5b6fb463ea8b155bdd8b9dd0e2c4723977bfb46618a283f6c822a57b3fdcc60e3a13fee0f42e90759f8fa13186251ebc0e0d36f2fd19161fe41261c524
SSDEEP 12288:BwpfEuE8NAKs/P4fxoDe8Hh+MpmiQcG5OmEBe2syEufWZNK9RPfDYU:qbah+MpKVqsqZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	832	PO_PT089110.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 580	832	PO_PT089110.exe	28
PID 832 wrote to memory of 580	832	PO_PT089110.exe	28
PID 832 wrote to memory of 580	832	PO_PT089110.exe	28
PID 832 wrote to memory of 580	832	PO_PT089110.exe	28
PID 832 wrote to memory of 1176	832	PO_PT089110.exe	29
PID 832 wrote to memory of 1176	832	PO_PT089110.exe	29
PID 832 wrote to memory of 1176	832	PO_PT089110.exe	29
PID 832 wrote to memory of 1176	832	PO_PT089110.exe	29
PID 832 wrote to memory of 432	832	PO_PT089110.exe	30
PID 832 wrote to memory of 432	832	PO_PT089110.exe	30
PID 832 wrote to memory of 432	832	PO_PT089110.exe	30
PID 832 wrote to memory of 432	832	PO_PT089110.exe	30
PID 832 wrote to memory of 1164	832	PO_PT089110.exe	31
PID 832 wrote to memory of 1164	832	PO_PT089110.exe	31
PID 832 wrote to memory of 1164	832	PO_PT089110.exe	31
PID 832 wrote to memory of 1164	832	PO_PT089110.exe	31
PID 832 wrote to memory of 1912	832	PO_PT089110.exe	32
PID 832 wrote to memory of 1912	832	PO_PT089110.exe	32
PID 832 wrote to memory of 1912	832	PO_PT089110.exe	32
PID 832 wrote to memory of 1912	832	PO_PT089110.exe	32

C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe
"C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe"
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe"
  2⤵
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe"
  2⤵
  PID:432
- C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe"
  2⤵
  PID:1164
- C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_PT089110.exe"
  2⤵
  PID:1912

memory/832-54-0x00000000003C0000-0x000000000048E000-memory.dmp

Download

memory/832-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Download

memory/832-56-0x00000000003A0000-0x00000000003B8000-memory.dmp

Download

memory/832-57-0x0000000000490000-0x000000000049C000-memory.dmp

Download

memory/832-58-0x00000000002F0000-0x0000000000370000-memory.dmp

Download

memory/832-59-0x0000000004140000-0x0000000004166000-memory.dmp

Download