ee4c7bdf3abd06150a2c2e6fe94bd41dc4157241c2a9cd4b6b0eb1842c70ee0b

Analysis

max time kernel
47s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 05:57

Target
bbx0BqhoWryhUrV.exe
Size 3.0MB
Sample221020-gnkrhagehl
SHA256 ee4c7bdf3abd06150a2c2e6fe94bd41dc4157241c2a9cd4b6b0eb1842c70ee0b
MD5 af3504a8c3832ead7682686b8c0c602c
SHA1 3a57b35d4e05a68bcc66358974755c47c427cb30
SHA512 9e60b567045525e2c0bee9de5a415cb4e2526b2cf4b316697cdd1bc14ddadb7ca0d5e220b75320c05db04d5dcb3754ae020b9c62de526cbcea1ac727e23be1a7
SSDEEP 49152:V0fWUgzTHIy72PiEVfUXb3nvf4giqp7aL4fTEOcF1LSMyZFdj:V0frgzToywiExULnGZL4rEOoy5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	bbx0BqhoWryhUrV.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 632	1976	bbx0BqhoWryhUrV.exe	28
PID 1976 wrote to memory of 632	1976	bbx0BqhoWryhUrV.exe	28
PID 1976 wrote to memory of 632	1976	bbx0BqhoWryhUrV.exe	28
PID 1976 wrote to memory of 632	1976	bbx0BqhoWryhUrV.exe	28
PID 1976 wrote to memory of 1516	1976	bbx0BqhoWryhUrV.exe	29
PID 1976 wrote to memory of 1516	1976	bbx0BqhoWryhUrV.exe	29
PID 1976 wrote to memory of 1516	1976	bbx0BqhoWryhUrV.exe	29
PID 1976 wrote to memory of 1516	1976	bbx0BqhoWryhUrV.exe	29
PID 1976 wrote to memory of 1488	1976	bbx0BqhoWryhUrV.exe	30
PID 1976 wrote to memory of 1488	1976	bbx0BqhoWryhUrV.exe	30
PID 1976 wrote to memory of 1488	1976	bbx0BqhoWryhUrV.exe	30
PID 1976 wrote to memory of 1488	1976	bbx0BqhoWryhUrV.exe	30
PID 1976 wrote to memory of 1748	1976	bbx0BqhoWryhUrV.exe	31
PID 1976 wrote to memory of 1748	1976	bbx0BqhoWryhUrV.exe	31
PID 1976 wrote to memory of 1748	1976	bbx0BqhoWryhUrV.exe	31
PID 1976 wrote to memory of 1748	1976	bbx0BqhoWryhUrV.exe	31
PID 1976 wrote to memory of 908	1976	bbx0BqhoWryhUrV.exe	32
PID 1976 wrote to memory of 908	1976	bbx0BqhoWryhUrV.exe	32
PID 1976 wrote to memory of 908	1976	bbx0BqhoWryhUrV.exe	32
PID 1976 wrote to memory of 908	1976	bbx0BqhoWryhUrV.exe	32

C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
"C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:632
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe
  "C:\Users\Admin\AppData\Local\Temp\bbx0BqhoWryhUrV.exe"
  2⤵
  PID:908

memory/1976-54-0x0000000000060000-0x0000000000368000-memory.dmp

Download

memory/1976-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Download

memory/1976-56-0x0000000001F70000-0x0000000001F88000-memory.dmp

Download

memory/1976-57-0x00000000007E0000-0x00000000007EC000-memory.dmp

Download

memory/1976-58-0x000000000AD70000-0x000000000AFF0000-memory.dmp

Download

memory/1976-59-0x000000000BFF0000-0x000000000C216000-memory.dmp

Download