3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-10-2022 05:56

Target

a1d9736DPC.exe
Size

1.7MB
MD5

7e9811681ab52fd4e2ac4441f6a3cc20
SHA1

201d2cf050703a3c030d996c01812ae7804f8008
SHA256

3f558725f854c9668efb18a9b88e4b24798170953fd74607f8678afa3982bffe
SHA512

a9aa1f53a006fc92934da39b3667b36da1a8803244b3e30ef29085408722f07a697c15286d33b00f1f261d5cdf84ade7f2b9376f8638d52205dc60b0d06a0f6b
SSDEEP

49152:1BteuU1W+Up1gB9/hsG5jtSXWOjhGBRjIugWeRpTC:QuU1F2gH/mjtGBxJgWWTC

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

a1d9736DPC.exe

pid process

1204 a1d9736DPC.exe
1204 a1d9736DPC.exe
1204 a1d9736DPC.exe
1204 a1d9736DPC.exe
1204 a1d9736DPC.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a1d9736DPC.exe

description pid process

Token: SeDebugPrivilege 1204 a1d9736DPC.exe

description	pid	process
Token: SeDebugPrivilege	1204	a1d9736DPC.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

a1d9736DPC.exe

description	pid	process	target process
PID 1204 wrote to memory of 1988	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 1988	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 1988	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 1988	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 268	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 268	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 268	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 268	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 580	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 580	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 580	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 580	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 552	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 552	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 552	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 552	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 588	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 588	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 588	1204	a1d9736DPC.exe	notepad.exe
PID 1204 wrote to memory of 588	1204	a1d9736DPC.exe	notepad.exe

memory/1204-54-0x00000000010E0000-0x0000000001294000-memory.dmp

Filesize
1.7MB

Download
memory/1204-55-0x000000001AF50000-0x000000001B0FA000-memory.dmp

Filesize
1.7MB

Download