d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 00:55

Target

d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe
Size

833KB
MD5

c2d048ea998382f15fd1d3e94ebd3712
SHA1

e6294f4091342a8bfe32b89087800d2f8596a631
SHA256

d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca
SHA512

e76506165951752613e12945fec456cdf7ad26a8cb345f54390699e8c19887ce8c006b85543af4ad5fdcc1c6f53194b2d7e4e894d6be6e179dc973adcef3ccc5
SSDEEP

12288:2TABwhaHQNxbJzhyxBPtC7JS2udrc7JSJBSNV3SFGGKUC729D1SsEA:VegQbbpSBPoSlRc7MJENAFh+29DgsE

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1512	d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2008	1512	d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe	27
PID 1512 wrote to memory of 2008	1512	d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe	27
PID 1512 wrote to memory of 2008	1512	d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe	27
PID 1512 wrote to memory of 2008	1512	d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe	27

C:\Users\Admin\AppData\Local\Temp\d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe
"C:\Users\Admin\AppData\Local\Temp\d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe
  C:\Users\Admin\AppData\Local\Temp\d215031b2cee4fdb4e59b211ab725a545421d71758353c520b96d0c1af5073ca.exe
  2⤵
  PID:2008

memory/1512-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1512-55-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download
memory/1512-56-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download