e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8

Analysis

max time kernel
36s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 09:37

Target

e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
Size

1.8MB
MD5

fd01f244df65f97d3366888a2c0c7b9e
SHA1

f1d418d7f95e08846d31bfbe37e118bf2c992352
SHA256

e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8
SHA512

70fddc5cd135cc83a39e9873f26f3a28016f3957114668cff4ac6b17f2b24b450ff2039517d1aa04049aa39ef7508144c7a2aa65e3ee39e679ba122d7c41ac23
SSDEEP

12288:2VnKTD0IOdQv8UxHxv3r84bPWI0PB8M2W7KzTVi5T+RssRlPZew0Rj4V/cDA1ORZ:2EOdQ0UDbuMEGIYewW4tcm7M8a

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe

pid	process
1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe

description	pid	process
Token: SeDebugPrivilege	1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
Token: 33	1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
Token: SeIncBasePriorityPrivilege	1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe

description	pid	process	target process
PID 1992 wrote to memory of 1528	1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
PID 1992 wrote to memory of 1528	1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
PID 1992 wrote to memory of 1528	1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
PID 1992 wrote to memory of 1528	1992	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe	e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe

C:\Users\Admin\AppData\Local\Temp\e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
C:\Users\Admin\AppData\Local\Temp\e6be87120070bad0c3b395a2523483bc003c2d2aebcadce0d84880ced2d8cea8.exe
2⤵
PID:1528

memory/1992-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x00000000746D0000-0x0000000074C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-56-0x00000000746D0000-0x0000000074C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-57-0x00000000746D0000-0x0000000074C7B000-memory.dmp

Filesize
5.7MB

Download