ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf

Analysis

max time kernel
151s
max time network
143s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 19:44

Target

ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe
Size

26KB
MD5

8083aed241fd0465571949e911d16d57
SHA1

7f49f4bccad4d3ee267da286a5f29e2fccdf6940
SHA256

ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf
SHA512

155b86cae2ac74353721974f753d4baa91cbd0018a642859e2a63c7648a4aa37d972b5e87a5184e19755fb771987a6dc4a57115c75ceda13538f7729a34aa529
SSDEEP

384:u1fYRcxUXlYT7d5gaUOi2HBCm0wvDHSJxaEIpTUJoLpzuKdyig2fdWS29aWQ:wYRUElERbfxFDHm41TUkuoVg4Q9E

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe
1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe
1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe
1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe
1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe
1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1536	1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe	26
PID 1504 wrote to memory of 1536	1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe	26
PID 1504 wrote to memory of 1536	1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe	26
PID 1504 wrote to memory of 1536	1504	ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe	26

C:\Users\Admin\AppData\Local\Temp\ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe
"C:\Users\Admin\AppData\Local\Temp\ad4f02a6c667f848c276655011fb146e78eaa112de6fa002767df390da2976bf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  PID:1536

memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-57-0x0000000001E30000-0x0000000002E30000-memory.dmp

Filesize
16.0MB

Download
memory/1504-60-0x0000000001E30000-0x0000000002E30000-memory.dmp

Filesize
16.0MB

Download
memory/1536-58-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/1536-59-0x00000000000A0000-0x00000000000A8000-memory.dmp

Filesize
32KB

Download