6c69f2907eccb9bc8715c3bbe0af8c8e55effab53abd16e5641b336f79bdc483

Analysis

max time kernel
56s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/11/2022, 02:23

Target
satin alma emri.exe
Size 839KB
Sample221112-ct5lmsgd2x
SHA256 6c69f2907eccb9bc8715c3bbe0af8c8e55effab53abd16e5641b336f79bdc483
MD5 d570fae4cdf655e485008e1c5a5c8a68
SHA1 80d93e12cb427fdcfc20ddb519f3143d7404f851
SHA512 5a1422e14a86a46d0f0bb4e78c740a652ff457cfdbe7036dbf08fc2cb0f244d271c73bbb9ee725d55f04e02743e592bc72a7ea801ffbd420b92508a0d85db726
SSDEEP 12288:8lYQGOFN45OHyuYTNruCZUDpaC/kkcIbL3Xfx8zHK:CZHyuIhgpaC/kkf3Xfxg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	satin alma emri.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1008	1064	satin alma emri.exe	27
PID 1064 wrote to memory of 1008	1064	satin alma emri.exe	27
PID 1064 wrote to memory of 1008	1064	satin alma emri.exe	27
PID 1064 wrote to memory of 1008	1064	satin alma emri.exe	27
PID 1064 wrote to memory of 460	1064	satin alma emri.exe	28
PID 1064 wrote to memory of 460	1064	satin alma emri.exe	28
PID 1064 wrote to memory of 460	1064	satin alma emri.exe	28
PID 1064 wrote to memory of 460	1064	satin alma emri.exe	28
PID 1064 wrote to memory of 856	1064	satin alma emri.exe	29
PID 1064 wrote to memory of 856	1064	satin alma emri.exe	29
PID 1064 wrote to memory of 856	1064	satin alma emri.exe	29
PID 1064 wrote to memory of 856	1064	satin alma emri.exe	29
PID 1064 wrote to memory of 628	1064	satin alma emri.exe	30
PID 1064 wrote to memory of 628	1064	satin alma emri.exe	30
PID 1064 wrote to memory of 628	1064	satin alma emri.exe	30
PID 1064 wrote to memory of 628	1064	satin alma emri.exe	30
PID 1064 wrote to memory of 556	1064	satin alma emri.exe	31
PID 1064 wrote to memory of 556	1064	satin alma emri.exe	31
PID 1064 wrote to memory of 556	1064	satin alma emri.exe	31
PID 1064 wrote to memory of 556	1064	satin alma emri.exe	31

C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe
"C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe
  "C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe"
  2⤵
  PID:1008
- C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe
  "C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe"
  2⤵
  PID:460
- C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe
  "C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe"
  2⤵
  PID:856
- C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe
  "C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe"
  2⤵
  PID:628
- C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe
  "C:\Users\Admin\AppData\Local\Temp\satin alma emri.exe"
  2⤵
  PID:556

memory/1064-54-0x0000000000340000-0x0000000000418000-memory.dmp

Download

memory/1064-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Download

memory/1064-56-0x00000000048B0000-0x000000000493A000-memory.dmp

Download

memory/1064-57-0x0000000001D60000-0x0000000001D78000-memory.dmp

Download

memory/1064-58-0x0000000000590000-0x000000000059C000-memory.dmp

Download

memory/1064-59-0x0000000004650000-0x00000000046B2000-memory.dmp

Download

memory/1064-60-0x00000000047B0000-0x00000000047D6000-memory.dmp

Download